starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2023-4756 (published 2023-09-04T09:15Z)

Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2023-09-04 09:35:27+02:00
msg: Fixed #2584
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: loader_bt.c
change_type: ModificationType.MODIFY
diff: @@ -134,7 +134,8 @@ static GF_Err gf_bt_report(GF_BTParser *parser, GF_Err e, char *format, ...)
 
 void gf_bt_check_line(GF_BTParser *parser)
 {
-	while (1) {
+reload_line:
+	while (parser->line_pos < parser->line_size) {
 		switch (parser->line_buffer[parser->line_pos]) {
 		case ' ':
 		case '\t':
@@ -142,16 +143,22 @@ void gf_bt_check_line(GF_BTParser *parser)
 		case '\r':
 			parser->line_pos++;
 			continue;
+		case '\0':
+			parser->line_pos = parser->line_size;
 		default:
 			break;
 		}
 		break;
 	}
 
-	if (parser->line_buffer[parser->line_pos]=='#') {
-		parser->line_size = parser->line_pos;
+	if (parser->line_pos < parser->line_size) {
+		if (parser->line_buffer[parser->line_pos]=='#') {
+			parser->line_size = parser->line_pos;
+		}
+		else if ((parser->line_buffer[parser->line_pos]=='/') && (parser->line_buffer[parser->line_pos+1]=='/') ) {
+			parser->line_size = parser->line_pos;
+		}
 	}
-	else if ((parser->line_buffer[parser->line_pos]=='/') && (parser->line_buffer[parser->line_pos+1]=='/') ) parser->line_size = parser->line_pos;
 
 	if (parser->line_size == parser->line_pos) {
 		/*string based input - done*/
@@ -405,10 +412,15 @@ next_line:
 		}
 	}
 	if (!parser->line_size) {
-		if (!gf_gzeof(parser->gz_in)) gf_bt_check_line(parser);
-		else parser->done = 1;
+		if (!gf_gzeof(parser->gz_in))
+			//avoid recursion
+			goto reload_line;
+		else
+			parser->done = 1;
 	}
-	else if (!parser->done && (parser->line_size == parser->line_pos)) gf_bt_check_line(parser);
+	else if (!parser->done && (parser->line_size == parser->line_pos))
+		//avoid recursion
+		goto reload_line;
 }
 
 void gf_bt_force_line(GF_BTParser *parser)

programming_language: C
CVE-2020-22617 (published 2021-10-08T20:15Z)

Ardour v5.12 contains a use-after-free vulnerability in the component ardour/libs/pbd/xml++.cc when using xmlFreeDoc and xmlXPathFreeContext.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/Ardour/ardour
commit_details: repo_url: https://github.com/Ardour/ardour
author: Paul Davis
author_date: 2020-03-11 08:49:42-06:00
msg: fix apparent free-ordering issue reported in #7926
repository: repo_url: https://github.com/Ardour/ardour
repo_name: Ardour/ardour
description: Mirror of Ardour Source Code
repo_language: C++
owner: Ardour
file_changes: filename: xml++.cc
change_type: ModificationType.MODIFY
diff: @@ -770,16 +770,16 @@ static XMLSharedNodeList* find_impl(xmlXPathContext* ctxt, const string& xpath)
 	xmlXPathObject* result = xmlXPathEval((const xmlChar*)xpath.c_str(), ctxt);
 
 	if (!result) {
-		xmlXPathFreeContext(ctxt);
 		xmlFreeDoc(ctxt->doc);
+		xmlXPathFreeContext(ctxt);
 
 		throw XMLException("Invalid XPath: " + xpath);
 	}
 
 	if (result->type != XPATH_NODESET) {
 		xmlXPathFreeObject(result);
-		xmlXPathFreeContext(ctxt);
 		xmlFreeDoc(ctxt->doc);
+		xmlXPathFreeContext(ctxt);
 
 		throw XMLException("Only nodeset result types are supported.");
 	}

programming_language: C++
CVE-2022-31001 (published 2022-05-31T20:15Z)

Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to FreeSWITCH, which may cause crash. This type of crash may be caused by `#define MATCH(s, m) (strncmp(s, m, n = sizeof(m) - 1) == 0)`, which will make `n` bigger and trigger out-of-bound access when `IS_NON_WS(s[n])`. Version 1.13.8 contains a patch for this issue.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/freeswitch/sofia-sip
commit_details: repo_url: https://github.com/freeswitch/sofia-sip
author: Andrey Volk
author_date: 2022-05-25 16:58:18+03:00
msg: Merge pull request from GHSA-79jq-hh82-cv9g

Fix Out-of-bound read in sip_method_d
repository: repo_url: https://github.com/freeswitch/sofia-sip
repo_name: freeswitch/sofia-sip
description: Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification.
repo_language: C
owner: freeswitch
CVE-2016-9556 (published 2017-03-23T18:59Z)

The IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3-8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2016-11-16 15:50:12-05:00
msg: https://github.com/ImageMagick/ImageMagick/issues/301
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: sgi.c
change_type: ModificationType.MODIFY
diff: @@ -332,6 +332,8 @@ static Image *ReadSGIImage(const ImageInfo *image_info,ExceptionInfo *exception)
     if ((iris_info.bytes_per_pixel == 0) || (iris_info.bytes_per_pixel > 2))
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     iris_info.dimension=ReadBlobMSBShort(image);
+    if ((iris_info.dimension == 0) || (iris_info.dimension > 3)) 
+      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     iris_info.columns=ReadBlobMSBShort(image);
     iris_info.rows=ReadBlobMSBShort(image);
     iris_info.depth=ReadBlobMSBShort(image);

programming_language: Objective-C
CVE-2020-14399 (published 2020-06-17T16:15Z)

An issue was discovered in LibVNCServer before 0.9.13. Byte-aligned data is accessed through uint32_t pointers in libvncclient/rfbproto.c. NOTE: there is reportedly "no trust boundary crossed.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/LibVNC/libvncserver
commit_details: repo_url: https://github.com/LibVNC/libvncserver
author: Tobias Junghans
author_date: 2020-05-27 11:47:00+02:00
msg: libvncclient: fix pointer aliasing/alignment issue

Accessing byte-aligned data through uint32_t pointers can cause crashes
on some platforms or reduce the performance. Therefore ensure a proper
stack alignment.
repository: repo_url: https://github.com/LibVNC/libvncserver
repo_name: LibVNC/libvncserver
description: LibVNCServer/LibVNCClient are cross-platform C libraries that allow you to easily implement VNC server or client functionality in your program.
repo_language: C
owner: LibVNC
file_changes: filename: rfbproto.c
change_type: ModificationType.MODIFY
diff: @@ -1151,10 +1151,13 @@ rfbBool
 SetFormatAndEncodings(rfbClient* client)
 {
   rfbSetPixelFormatMsg spf;
-  char buf[sz_rfbSetEncodingsMsg + MAX_ENCODINGS * 4];
+  union {
+    char bytes[sz_rfbSetEncodingsMsg + MAX_ENCODINGS*4];
+    rfbSetEncodingsMsg msg;
+  } buf;
 
-  rfbSetEncodingsMsg *se = (rfbSetEncodingsMsg *)buf;
-  uint32_t *encs = (uint32_t *)(&buf[sz_rfbSetEncodingsMsg]);
+  rfbSetEncodingsMsg *se = &buf.msg;
+  uint32_t *encs = (uint32_t *)(&buf.bytes[sz_rfbSetEncodingsMsg]);
   int len = 0;
   rfbBool requestCompressLevel = FALSE;
   rfbBool requestQualityLevel = FALSE;
@@ -1354,7 +1357,7 @@ SetFormatAndEncodings(rfbClient* client)
 
   se->nEncodings = rfbClientSwap16IfLE(se->nEncodings);
 
-  if (!WriteToRFBServer(client, buf, len)) return FALSE;
+  if (!WriteToRFBServer(client, buf.bytes, len)) return FALSE;
 
   return TRUE;
 }

programming_language: C
CVE-2024-29196 (published 2024-03-26T03:15Z)

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. There is a Path Traversal vulnerability in Attachments that allows attackers with admin rights to upload malicious files to other locations of the web root. This vulnerability is fixed in 3.2.6.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/thorsten/phpMyFAQ
commit_details: repo_url: https://github.com/thorsten/phpMyFAQ
author: Thorsten Rinne
author_date: 2024-03-20 13:29:38+01:00
msg: fix: improved check on path
repository: repo_url: https://github.com/thorsten/phpMyFAQ
repo_name: thorsten/phpMyFAQ
description: phpMyFAQ - Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases
repo_language: PHP
owner: thorsten
file_changes: filename: configuration.php
change_type: ModificationType.MODIFY
diff: @@ -19,6 +19,7 @@ use phpMyFAQ\Filter;
 use phpMyFAQ\Session\Token;
 use phpMyFAQ\Strings;
 use phpMyFAQ\Translation;
+use Symfony\Component\HttpFoundation\Request;
 
 if (!defined('IS_VALID_PHPMYFAQ')) {
     http_response_code(400);
@@ -59,11 +60,15 @@ if ($user->perm->hasPermission($user->getUserId(), 'editconfig')) {
             unset($editData['edit']['main.currentVersion']); // don't update the version number
         }
         if (isset($editData['edit']['records.attachmentsPath'])) {
-            $editData['edit']['records.attachmentsPath'] = str_replace(
-                '../',
-                '',
-                $editData['edit']['records.attachmentsPath']
-            );
+            if (false !== realpath($editData['edit']['records.attachmentsPath'])) {
+                $editData['edit']['records.attachmentsPath'] = str_replace(
+                    Request::createFromGlobals()->server->get('DOCUMENT_ROOT') . DIRECTORY_SEPARATOR,
+                    '',
+                    realpath($editData['edit']['records.attachmentsPath'])
+                );
+            } else {
+                unset($editData['edit']['records.attachmentsPath']);
+            }
         }
 
         if (

programming_language: PHP
CVE-2023-0298 (published 2023-01-14T08:15Z)

Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/firefly-iii/firefly-iii
commit_details: repo_url: https://github.com/firefly-iii/firefly-iii
author: James Cole
author_date: 2023-01-14 07:55:11+01:00
msg: Merge pull request #6850 from firefly-iii/fix-auth-issue

Expand authentication validation in API.
repository: repo_url: https://github.com/firefly-iii/firefly-iii
repo_name: firefly-iii/firefly-iii
description: Firefly III: a personal finances manager
repo_language: PHP
owner: firefly-iii
CVE-2018-11376 (published 2018-05-22T19:29Z)

The r_read_le32() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted ELF file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/radare/radare2
commit_details: repo_url: https://github.com/radare/radare2
author: radare
author_date: 2018-04-18 13:38:22+02:00
msg: Fix #9904 - crash in r2_hoobr_r_read_le32 (over 9000 entrypoints) and read_le oobread (#9923)
repository: repo_url: https://github.com/radare/radare2
repo_name: radareorg/radare2
description: UNIX-like reverse engineering framework and command-line toolset
repo_language: C
owner: radare
file_changes: filename: bin_elf.c
change_type: ModificationType.MODIFY
diff: @@ -348,7 +348,7 @@ static void process_constructors (RBinFile *bf, RList *ret, int bits) {
 			}
 			(void)r_buf_read_at (bf->buf, sec->paddr, buf, sec->size);
 			if (bits == 32) {
-				for (i = 0; i < sec->size; i += 4) {
+				for (i = 0; (i + 3) < sec->size; i += 4) {
 					ut32 addr32 = r_read_le32 (buf + i);
 					if (addr32) {
 						RBinAddr *ba = newEntry (sec->paddr + i, (ut64)addr32, type, bits);
@@ -356,7 +356,7 @@ static void process_constructors (RBinFile *bf, RList *ret, int bits) {
 					}
 				}
 			} else {
-				for (i = 0; i < sec->size; i += 8) {
+				for (i = 0; (i + 7) < sec->size; i += 8) {
 					ut64 addr64 = r_read_le64 (buf + i);
 					if (addr64) {
 						RBinAddr *ba = newEntry (sec->paddr + i, addr64, type, bits);

programming_language: C
filename: cbin.c
change_type: ModificationType.MODIFY
diff: @@ -1044,6 +1044,10 @@ static int bin_entry(RCore *r, int mode, ut64 laddr, int va, bool inifin) {
 			r_cons_printf ("[Entrypoints]\n");
 		}
 	}
+	if (r_list_length (entries) > 1024) {
+		eprintf ("Too many entrypoints (%d)\n", r_list_length (entries));
+		return false;
+	}
 
 	r_list_foreach (entries, iter, entry) {
 		ut64 paddr = entry->paddr;

programming_language: C
CVE-2021-23664 (published 2022-01-21T20:15Z)

The package @isomorphic-git/cors-proxy before 2.7.1 are vulnerable to Server-side Request Forgery (SSRF) due to missing sanitization and validation of the redirection action in middleware.js.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-918
cwe_name: Server-Side Request Forgery (SSRF)
description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
extended_description: By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
         

Fix information:
repo_url: https://github.com/isomorphic-git/cors-proxy
commit_details: repo_url: https://github.com/isomorphic-git/cors-proxy
author: William Hilton
author_date: 2022-01-06 21:30:39-05:00
msg: fix(security): don't follow redirects (#10)
repository: repo_url: https://github.com/isomorphic-git/cors-proxy
repo_name: isomorphic-git/cors-proxy
description: Proxy clone and push requests for the browser
repo_language: JavaScript
owner: isomorphic-git
file_changes: filename: azure-pipelines.yml
change_type: ModificationType.MODIFY
diff: @@ -2,7 +2,7 @@ jobs:
 - job: Linux
 
   pool:
-    vmImage: 'Ubuntu 16.04'
+    vmImage: 'ubuntu-latest'
 
   steps:
   - task: NodeTool@0

programming_language: CoffeeScript
filename: middleware.js
change_type: ModificationType.MODIFY
diff: @@ -35,6 +35,7 @@ const exposeHeaders = [
   'etag',
   'expires',
   'last-modified',
+  'location',
   'pragma',
   'server',
   'transfer-encoding',
@@ -125,10 +126,16 @@ module.exports = ({ origin, insecure_origins = [], authorization = noop } = {})
       `${protocol}://${pathdomain}/${remainingpath}`,
       {
         method: req.method,
+        redirect: 'manual',
         headers,
         body: (req.method !== 'GET' && req.method !== 'HEAD') ? req : undefined
       }
     ).then(f => {
+      if (f.headers.has('location')) {
+        // Modify the location so the client continues to use the proxy
+        let newUrl = f.headers.get('location').replace(/^https?:\//, '')
+        f.headers.set('location', newUrl)
+      }
       res.statusCode = f.status
       for (let h of exposeHeaders) {
         if (h === 'content-length') continue

programming_language: JavaScript
CVE-2021-25941 (published 2021-05-14T14:15Z)

Prototype pollution vulnerability in 'deep-override' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-1321
cwe_name: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
description: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
extended_description: 
				By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the product depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).
				This weakness is usually exploited by using a special attribute of objects called proto,  constructor or prototype. Such attributes give access to the object prototype. This weakness is often found in code that assigns object attributes based on user input, or merges or clones objects recursively.
			
			

Fix information:
repo_url: https://github.com/ASaiAnudeep/deep-override
commit_details: repo_url: https://github.com/ASaiAnudeep/deep-override
author: Arjun Shibu
author_date: 2020-12-17 22:31:18+05:30
msg: Security fix for Prototype Pollution
repository: repo_url: https://github.com/ASaiAnudeep/deep-override
repo_name: ASaiAnudeep/deep-override
description: recursive object extending
repo_language: JavaScript
owner: ASaiAnudeep
file_changes: filename: index.js
change_type: ModificationType.MODIFY
diff: @@ -46,6 +46,8 @@ function override(...rawArgs) {
       });
     } else {
       Object.keys(obj).forEach(key => {
+        if (key == '__proto__' || key == 'constructor' || key == 'prototype')
+          return
         src = target[key];
         val = obj[key];
         if (val === target) {
@@ -69,4 +71,4 @@ function override(...rawArgs) {
   return target;
 }
 
-module.exports = override;
\ No newline at end of file
+module.exports = override;

programming_language: JavaScript