starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-39346 (published 2023-08-04T21:15Z)

LinuxASMCallGraph is software for drawing the call graph of the programming code. Linux ASMCallGraph before commit 20dba06bd1a3cf260612d4f21547c25002121cd5 allows attackers to cause a remote code execution on the server side via uploading a crafted ZIP file due to incorrect filtering rules of uploaded file. The problem has been patched in commit 20dba06bd1a3cf260612d4f21547c25002121cd5. There are no known workarounds.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/bjrjk/LinuxASMCallGraph
commit_details: repo_url: https://github.com/bjrjk/LinuxASMCallGraph
author: Jack Ren
author_date: 2022-02-08 16:29:04+08:00
msg: Fixed Vulnerability

Fixed Vulnerability #6 and #8.
repository: repo_url: https://github.com/bjrjk/LinuxASMCallGraph
repo_name: bjrjk/LinuxASMCallGraph
description: Generate Function Call Graph from the ASM of GNU gcc & g++.
repo_language: Python
owner: bjrjk
file_changes: filename: index.php
change_type: ModificationType.MODIFY
diff: @@ -32,12 +32,15 @@ if (isset($_FILES["file"])) {
         }
         header("Location:  tmp/$fileMD5.png");
     } else {
-        $command = "unzip -l \"$fullName.zip\" | grep php 2>&1";
+        $command = "zipinfo \"$fullName.zip\" | grep -P l[rwx-]{9} 2>&1";
         exec($command,$message,$retCode);
         if(count($message)){
-            die("Don't try to do bad things!");
+            die("Don't try to do bad! You tricky Linux hacker boy!");
+        }
+        $command = "unzip \"$fullName.zip\" -d \"$fullName\" | grep -P \".php|.htaccess\" 2>&1";
+		if(count($message)){
+            die("Don't try to do bad! You tricky web hacker boy!");
         }
-        $command = "unzip \"$fullName.zip\" -d \"$fullName\" 2>&1";
         exec($command,$message,$retCode);
         if($retCode != 0){
             die("unzip error!");

programming_language: PHP
CVE-2022-23654 (published 2022-02-22T20:15Z)

Wiki.js is a wiki app built on Node.js. In affected versions an authenticated user with write access on a restricted set of paths can update a page outside the allowed paths by specifying a different target page ID while keeping the path intact. The access control incorrectly check the path access against the user-provided values instead of the actual path associated to the page ID. Commit https://github.com/Requarks/wiki/commit/411802ec2f654bb5ed1126c307575b81e2361c6b fixes this vulnerability by checking access control on the path associated with the page ID instead of the user-provided value. When the path is different than the current value, a second access control check is then performed on the user-provided path before the move operation.

Severity: LOW
CVSS v2 base score: 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Requarks/wiki
commit_details: repo_url: https://github.com/Requarks/wiki
author: NGPixel
author_date: 2022-02-20 18:46:03-05:00
msg: fix: check update page access using original page path
repository: repo_url: https://github.com/Requarks/wiki
repo_name: requarks/wiki
description: Wiki.js | A modern and powerful wiki app built on Node.js
repo_language: Vue
owner: Requarks
file_changes: filename: pages.js
change_type: ModificationType.MODIFY
diff: @@ -371,8 +371,8 @@ module.exports = class Page extends Model {
 
     // -> Check for page access
     if (!WIKI.auth.checkAccess(opts.user, ['write:pages'], {
-      locale: opts.locale,
-      path: opts.path
+      locale: ogPage.localeCode,
+      path: ogPage.path
     })) {
       throw new WIKI.Error.PageUpdateForbidden()
     }
@@ -456,6 +456,14 @@ module.exports = class Page extends Model {
 
     // -> Perform move?
     if ((opts.locale && opts.locale !== page.localeCode) || (opts.path && opts.path !== page.path)) {
+      // -> Check target path access
+      if (!WIKI.auth.checkAccess(opts.user, ['write:pages'], {
+        locale: opts.locale,
+        path: opts.path
+      })) {
+        throw new WIKI.Error.PageMoveForbidden()
+      }
+
       await WIKI.models.pages.movePage({
         id: page.id,
         destinationLocale: opts.locale,

programming_language: CoffeeScript
CVE-2024-6062 (published 2024-06-17T20:15Z)

A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this issue is the function swf_svg_add_iso_sample of the file src/filters/load_text.c of the component MP4Box. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 31e499d310a48bd17c8b055a0bfe0fe35887a7cd. It is recommended to apply a patch to fix this issue. VDB-268790 is the identifier assigned to this vulnerability.


Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2024-06-12 15:31:30+02:00
msg: fixed #2872
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: load_text.c
change_type: ModificationType.MODIFY
diff: @@ -2535,6 +2535,7 @@ static GF_Err swf_svg_add_iso_sample(void *user, const u8 *data, u32 length, u64
 	GF_FilterPacket *pck;
 	u8 *pck_data;
 	GF_TXTIn *ctx = (GF_TXTIn *)user;
+	if (!data || !length) return GF_BAD_PARAM;
 
 	if (ctx->seek_state==2) {
 		Double ts = (Double) timestamp;

programming_language: C
CVE-2017-7862 (published 2017-04-14T04:59Z)

FFmpeg before 2017-02-07 has an out-of-bounds write caused by a heap-based buffer overflow related to the decode_frame function in libavcodec/pictordec.c.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/FFmpeg/FFmpeg
commit_details: repo_url: https://github.com/FFmpeg/FFmpeg
author: Michael Niedermayer
author_date: 2017-02-07 15:49:09+01:00
msg: avcodec/pictordec: Fix logic error

Fixes: 559/clusterfuzz-testcase-6424225917173760

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
repository: repo_url: https://github.com/FFmpeg/FFmpeg
repo_name: FFmpeg/FFmpeg
description: Mirror of https://git.ffmpeg.org/ffmpeg.git
repo_language: C
owner: FFmpeg
file_changes: filename: pictordec.c
change_type: ModificationType.MODIFY
diff: @@ -142,7 +142,7 @@ static int decode_frame(AVCodecContext *avctx,
 
     if (av_image_check_size(s->width, s->height, 0, avctx) < 0)
         return -1;
-    if (s->width != avctx->width && s->height != avctx->height) {
+    if (s->width != avctx->width || s->height != avctx->height) {
         ret = ff_set_dimensions(avctx, s->width, s->height);
         if (ret < 0)
             return ret;

programming_language: C
CVE-2023-2839 (published 2023-05-22T18:15Z)

Divide By Zero in GitHub repository gpac/gpac prior to 2.2.2.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2023-05-22 17:48:08+02:00
msg: fixed #2476
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: reframe_nalu.c
change_type: ModificationType.MODIFY
diff: @@ -1509,10 +1509,13 @@ Bool naludmx_create_avc_decoder_config(GF_NALUDmxCtx *ctx, u8 **dsi, u32 *dsi_si
 					else
 						DeltaTfiDivisorIdx = (ctx->avc_state->sei.pic_timing.pic_struct+1) / 2;
 				}
-				if (ctx->notime && sps->vui.time_scale && sps->vui.num_units_in_tick) {
-					ctx->cur_fps.num = 2 * sps->vui.time_scale;
-					ctx->cur_fps.den = 2 * sps->vui.num_units_in_tick * DeltaTfiDivisorIdx;
-
+				if (ctx->notime) {
+					u32 fps_num = 2 * sps->vui.time_scale;
+					u32 fps_den = 2 * sps->vui.num_units_in_tick * DeltaTfiDivisorIdx;
+					if (fps_num && fps_den) {
+						ctx->cur_fps.num = fps_num;
+						ctx->cur_fps.den = fps_den;
+					}
 					if (!ctx->fps.num && ctx->dts==ctx->fps.den)
 						ctx->dts = ctx->cur_fps.den;
 				}

programming_language: C
CVE-2023-38403 (published 2023-07-17T21:15Z)

iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-190
cwe_name: Integer Overflow or Wraparound
description: The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
extended_description: 
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/esnet/iperf
commit_details: repo_url: https://github.com/esnet/iperf
author: Bruce A. Mah
author_date: 2023-07-07 11:35:02-07:00
msg: Fix memory allocation hazard (#1542). (#1543)

Reported by:	@someusername123 on GitHub
repository: repo_url: https://github.com/esnet/iperf
repo_name: esnet/iperf
description: iperf3:  A TCP, UDP, and SCTP network bandwidth measurement tool
repo_language: C
owner: esnet
file_changes: filename: iperf_api.c
change_type: ModificationType.MODIFY
diff: @@ -2670,6 +2670,7 @@ static cJSON *
 JSON_read(int fd)
 {
     uint32_t hsize, nsize;
+    size_t strsize;
     char *str;
     cJSON *json = NULL;
     int rc;
@@ -2682,7 +2683,9 @@ JSON_read(int fd)
     if (Nread(fd, (char*) &nsize, sizeof(nsize), Ptcp) >= 0) {
 	hsize = ntohl(nsize);
 	/* Allocate a buffer to hold the JSON */
-	str = (char *) calloc(sizeof(char), hsize+1);	/* +1 for trailing null */
+	strsize = hsize + 1;              /* +1 for trailing NULL */
+	if (strsize) {
+	str = (char *) calloc(sizeof(char), strsize);
 	if (str != NULL) {
 	    rc = Nread(fd, str, hsize, Ptcp);
 	    if (rc >= 0) {
@@ -2701,6 +2704,10 @@ JSON_read(int fd)
 	    }
 	}
 	free(str);
+	}
+	else {
+	    printf("WARNING:  Data length overflow\n");
+	}
     }
     return json;
 }

programming_language: C
CVE-2023-4781 (published 2023-09-05T19:15Z)

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-122
cwe_name: Heap-based Buffer Overflow
description: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/vim/vim
commit_details: repo_url: https://github.com/vim/vim
author: Christian Brabandt
author_date: 2023-09-05 20:18:06+02:00
msg: patch 9.0.1873: [security] heap-buffer-overflow in vim_regsub_both

Problem:  heap-buffer-overflow in vim_regsub_both
Solution: Disallow exchanging windows when textlock is active

Signed-off-by: Christian Brabandt <cb@256bit.org>
repository: repo_url: https://github.com/vim/vim
repo_name: vim/vim
description: The official Vim repository
repo_language: Vim Script
owner: vim
file_changes: filename: ex_cmds.c
change_type: ModificationType.MODIFY
diff: @@ -4519,6 +4519,9 @@ ex_substitute(exarg_T *eap)
 		{
 		    nmatch = curbuf->b_ml.ml_line_count - sub_firstlnum + 1;
 		    skip_match = TRUE;
+		    // safety check
+		    if (nmatch < 0)
+			goto skip;
 		}
 
 		// Need room for:

programming_language: C
filename: test_crash.vim
change_type: ModificationType.MODIFY
diff: @@ -46,6 +46,7 @@ func Test_crash1()
 
   let file = 'crash/poc_tagfunc.vim'
   let args = printf(cmn_args, vim, file)
+  " using || because this poc causes vim to exit with exitstatus != 0
   call term_sendkeys(buf, args ..
     \ '  || echo "crash 5: [OK]" >> X_crash1_result.txt' .. "\<cr>")
 
@@ -59,6 +60,13 @@ func Test_crash1()
   call delete('X')
   call TermWait(buf, 3000)
 
+  let file = 'crash/vim_regsub_both_poc'
+  let args = printf(cmn_args, vim, file)
+  " using || because this poc causes vim to exit with exitstatus != 0
+  call term_sendkeys(buf, args ..
+    \ '  && echo "crash 7: [OK]" >> X_crash1_result.txt' .. "\<cr>")
+  call TermWait(buf, 1000)
+
   " clean up
   exe buf .. "bw!"
 
@@ -71,6 +79,7 @@ func Test_crash1()
       \ 'crash 4: [OK]',
       \ 'crash 5: [OK]',
       \ 'crash 6: [OK]',
+      \ 'crash 7: [OK]',
       \ ]
 
   call assert_equal(expected, getline(1, '$'))

programming_language: Shell
filename: version.c
change_type: ModificationType.MODIFY
diff: @@ -699,6 +699,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1873,
 /**/
     1872,
 /**/

programming_language: Ruby
filename: window.c
change_type: ModificationType.MODIFY
diff: @@ -1733,6 +1733,11 @@ win_exchange(long Prenum)
 	beep_flush();
 	return;
     }
+    if (text_or_buf_locked())
+    {
+	beep_flush();
+	return;
+    }
 
 #ifdef FEAT_GUI
     need_mouse_correct = TRUE;

programming_language: C
CVE-2023-26468 (published 2023-02-24T00:15Z)

Cerebrate 1.12 does not properly consider organisation_id during creation of API keys.

CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/cerebrate-project/cerebrate
commit_details: repo_url: https://github.com/cerebrate-project/cerebrate
author: Sami Mokaddem
author_date: 2023-02-23 14:57:42+01:00
msg: security: [authkey:add] Restrict creation of API keys for users in the same org and for other org_admins
repository: repo_url: https://github.com/cerebrate-project/cerebrate
repo_name: cerebrate-project/cerebrate
description: Cerebrate is an open-source platform meant to act as a trusted contact information provider and interconnection orchestrator for other security tools.
repo_language: PHP
owner: cerebrate-project
file_changes: filename: AuthKeysController.php
change_type: ModificationType.MODIFY
diff: @@ -71,8 +71,12 @@ class AuthKeysController extends AppController
             if (empty($currentUser['role']['perm_org_admin'])) {
                 $userConditions['id'] = $currentUser['id'];
             } else {
-                $role_ids = $this->Users->Roles->find()->where(['perm_admin' => 0])->all()->extract('id')->toList();
-                $userConditions['role_id IN'] = $role_ids;
+                $role_ids = $this->Users->Roles->find()->where(['perm_admin' => 0, 'perm_org_admin' => 0])->all()->extract('id')->toList();
+                $userConditions['organisation_id'] = $currentUser['organisation_id'];
+                $userConditions['OR'] = [
+                    ['role_id IN' => $role_ids],
+                    ['id' => $currentUser['id']],
+                ];
             }
         }
         $users = $this->Users->find('list');

programming_language: PHP
CVE-2020-7693 (published 2020-07-09T14:15Z)

Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Weakness information:
cwe_id: CWE-755
cwe_name: Improper Handling of Exceptional Conditions
description: The product does not handle or incorrectly handles an exceptional condition.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/sockjs/sockjs-node
commit_details: repo_url: https://github.com/sockjs/sockjs-node
author: Bryce Kahle
author_date: 2020-03-08 21:36:12-04:00
msg: Merge pull request #266 from cakoose/backport-writeHead-fix

writeHead: Don't end() response
repository: repo_url: https://github.com/sockjs/sockjs-node
repo_name: sockjs/sockjs-node
description: WebSocket emulation - Node.js server
repo_language: JavaScript
owner: sockjs
CVE-2022-25319 (published 2022-02-18T06:15Z)

An issue was discovered in Cerebrate through 1.4. Endpoints could be open even when not enabled.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/cerebrate-project/cerebrate
commit_details: repo_url: https://github.com/cerebrate-project/cerebrate
author: iglocska
author_date: 2022-02-04 00:36:31+01:00
msg: fix: [security] open endpoints should only be open when enabled

- as reported by Dawid Czarnecki from Zigrin Security
repository: repo_url: https://github.com/cerebrate-project/cerebrate
repo_name: cerebrate-project/cerebrate
description: Cerebrate is an open-source platform meant to act as a trusted contact information provider and interconnection orchestrator for other security tools.
repo_language: PHP
owner: cerebrate-project
file_changes: filename: IndividualsController.php
change_type: ModificationType.MODIFY
diff: @@ -11,13 +11,17 @@ use Cake\Http\Exception\NotFoundException;
 use Cake\Http\Exception\MethodNotAllowedException;
 use Cake\Http\Exception\ForbiddenException;
 use Cake\Event\EventInterface;
+use Cake\Core\Configure;
 
 class IndividualsController extends AppController
 {
     public function beforeFilter(EventInterface $event)
     {
         parent::beforeFilter($event);
-        $this->Authentication->allowUnauthenticated(['index']);
+        $open = Configure::read('Cerebrate.open');
+        if (!empty($open) && in_array('individuals', $open)) {
+            $this->Authentication->allowUnauthenticated(['index']);
+        }
     }
 
     public function index()

programming_language: PHP
filename: OrganisationsController.php
change_type: ModificationType.MODIFY
diff: @@ -10,13 +10,17 @@ use Cake\Http\Exception\NotFoundException;
 use Cake\Http\Exception\MethodNotAllowedException;
 use Cake\Http\Exception\ForbiddenException;
 use Cake\Event\EventInterface;
+use Cake\Core\Configure;
 
 class OrganisationsController extends AppController
 {
     public function beforeFilter(EventInterface $event)
     {
         parent::beforeFilter($event);
-        $this->Authentication->allowUnauthenticated(['index']);
+        $open = Configure::read('Cerebrate.open');
+        if (!empty($open) && in_array('organisations', $open)) {
+            $this->Authentication->allowUnauthenticated(['index']);
+        }
     }
 
     public function index()

programming_language: PHP
CVE-2019-25102 (published 2023-02-12T14:15Z)

A vulnerability, which was classified as problematic, was found in simple-markdown 0.6.0. Affected is an unknown function of the file simple-markdown.js. The manipulation with the input <<<<<<<<<<:/:/:/:/:/:/:/:/:/:/ leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.6.1 is able to address this issue. The patch is identified as 015a719bf5cdc561feea05500ecb3274ef609cd2. It is recommended to upgrade the affected component. VDB-220638 is the identifier assigned to this vulnerability.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-1333
cwe_name: Inefficient Regular Expression Complexity
description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
extended_description: Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match.
                Backtracking becomes a weakness if all of these conditions are met:
                
                    The number of possible backtracking attempts are exponential relative to the length of the input.
                    The input can fail to match the regular expression.
                    The input can be long enough.
                
		
		  Attackers can create crafted inputs that
		  intentionally cause the regular expression to use
		  excessive backtracking in a way that causes the CPU
		  consumption to spike.
		
            
            

Fix information:
repo_url: https://github.com/ariabuckles/simple-markdown
commit_details: repo_url: https://github.com/ariabuckles/simple-markdown
author: Alcaro
author_date: 2019-09-25 22:55:54+02:00
msg: Fix ReDoS with autolink

Patterns like <<<<<<<<<<:/:/:/:/:/:/:/:/:/:/ currently exhibit O(n^3) complexity, allowing a 5KB document to take 7174ms to parse. With this change, it drops to O(n^2) and 73ms.
repository: repo_url: https://github.com/ariabuckles/simple-markdown
repo_name: ariabuckles/simple-markdown
description: JavaScript markdown parsing, made simple
repo_language: JavaScript
owner: ariabuckles
file_changes: filename: simple-markdown.js
change_type: ModificationType.MODIFY
diff: @@ -1316,7 +1316,7 @@ var defaultRules /* : DefaultRules */ = {
     },
     autolink: {
         order: currOrder++,
-        match: inlineRegex(/^<([^ >]+:\/[^ >]+)>/),
+        match: inlineRegex(/^<([^: >]+:\/[^ >]+)>/),
         parse: function(capture, parse, state) {
             return {
                 type: "link",

programming_language: TypeScript