starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2024-35241 (published 2024-06-10T22:15Z)

Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used to execute code. Patches for this issue are available in version 2.2.24 for 2.2 LTS or 2.7.7 for mainline. As a workaround, avoid installing dependencies via git by using `--prefer-dist` or the `preferred-install: dist` config setting.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/composer/composer
commit_details: repo_url: https://github.com/composer/composer
author: Jordi Boggiano
author_date: 2024-06-10 14:56:42+02:00
msg: Merge pull request from GHSA-47f6-5gq3-vx9c
repository: repo_url: https://github.com/composer/composer
repo_name: composer/composer
description: Dependency Manager for PHP
repo_language: PHP
owner: composer
file_changes: filename: GitDownloader.php
change_type: ModificationType.MODIFY
diff: @@ -294,9 +294,9 @@ public function getUnpushedChanges(PackageInterface $package, string $path): ?st
                     $unpushedChanges = null;
                 }
                 foreach ($remoteBranches as $remoteBranch) {
-                    $command = sprintf('git diff --name-status %s...%s --', $remoteBranch, $branch);
+                    $command = ['git', 'diff', '--name-status', $remoteBranch.'...'.$branch, '--'];
                     if (0 !== $this->process->execute($command, $output, $path)) {
-                        throw new \RuntimeException('Failed to execute ' . $command . "\n\n" . $this->process->getErrorOutput());
+                        throw new \RuntimeException('Failed to execute ' . implode(' ', $command) . "\n\n" . $this->process->getErrorOutput());
                     }
 
                     $output = trim($output);

programming_language: PHP
CVE-2012-0973 (published 2012-09-25T23:55Z)

Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the (1) osc_search_category_id function in oc-includes/osclass/helpers/hSearch.php and (2) findBySlug function oc-includes/osclass/model/Category.php.  NOTE: some of these details are obtained from third party information.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/osclass/OSClass
commit_details: repo_url: https://github.com/osclass/OSClass
author: Juan Ramón
author_date: 2012-01-16 19:44:06+01:00
msg: OSClass 2.3.5
repository: repo_url: https://github.com/osclass/OSClass
repo_name: osclass/Osclass
description: With Osclass, get your own  classifieds site for free. Build your own Osclass installation and start advertising real estate, jobs or whatever you want- in minutes!
repo_language: PHP
owner: osclass
CVE-2021-43404 (published 2021-11-05T18:15Z)

An issue was discovered in FusionPBX before 4.5.30. The FAX file name may have risky characters.

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/fusionpbx/fusionpbx
commit_details: repo_url: https://github.com/fusionpbx/fusionpbx
author: FusionPBX
author_date: 2021-11-03 15:30:01-06:00
msg: Change the fax file name to md5 to avoid characters that present a security risk.
repository: repo_url: https://github.com/fusionpbx/fusionpbx
repo_name: fusionpbx/fusionpbx
description: Official FusionPBX - A full-featured domain based multi-tenant PBX and voice switch for FreeSwitch.
repo_language: PHP
owner: fusionpbx
file_changes: filename: fax_send.php
change_type: ModificationType.MODIFY
diff: @@ -351,28 +351,10 @@ if (!function_exists('fax_split_dtmf')) {
 				$disallowed_file_extensions = explode(',','sh,ssh,so,dll,exe,bat,vbs,zip,rar,z,tar,tbz,tgz,gz');
 				if (in_array($fax_file_extension, $disallowed_file_extensions) || $fax_file_extension == '') { continue; }
 
-				$fax_name = $_files['name'][$index];
-				$fax_name = preg_replace('/\\.[^.\\s]{3,4}$/', '', $fax_name);
-				$fax_name = str_replace(" ", "_", $fax_name);
-
-				//lua doesn't seem to like special chars with env:GetHeader
-				$fax_name = str_replace(";", "_", $fax_name);
-				$fax_name = str_replace(",", "_", $fax_name);
-				$fax_name = str_replace("'", "_", $fax_name);
-				$fax_name = str_replace("!", "_", $fax_name);
-				$fax_name = str_replace("@", "_", $fax_name);
-				$fax_name = str_replace("#", "_", $fax_name);
-				$fax_name = str_replace("$", "_", $fax_name);
-				$fax_name = str_replace("%", "_", $fax_name);
-				$fax_name = str_replace("^", "_", $fax_name);
-				$fax_name = str_replace("`", "_", $fax_name);
-				$fax_name = str_replace("~", "_", $fax_name);
-				$fax_name = str_replace("&", "_", $fax_name);
-				$fax_name = str_replace("(", "_", $fax_name);
-				$fax_name = str_replace(")", "_", $fax_name);
-				$fax_name = str_replace("+", "_", $fax_name);
-				$fax_name = str_replace("=", "_", $fax_name);
+				//use a safe file name
+				$fax_name = md5($_files['name'][$index]);
 
+				//rename the file
 				$attachment_file_name = $_files['name'][$index];
 				if ($attachment_file_name != $fax_name.'.'.$fax_file_extension) {
 					rename($dir_fax_temp.'/'.$attachment_file_name, $dir_fax_temp.'/'.$fax_name.'.'.$fax_file_extension);
@@ -382,7 +364,7 @@ if (!function_exists('fax_split_dtmf')) {
 				if (!$included) {
 					//check if directory exists
 					if (!is_dir($dir_fax_temp)) {
-						event_socket_mkdir($dir_fax_temp);
+						mkdir($dir_fax_temp, 0770);
 					}
 					//move uploaded file
 					move_uploaded_file($_files['tmp_name'][$index], $dir_fax_temp.'/'.$fax_name.'.'.$fax_file_extension);

programming_language: PHP
CVE-2012-1583 (published 2012-06-16T21:55Z)

Double free vulnerability in the xfrm6_tunnel_rcv function in net/ipv6/xfrm6_tunnel.c in the Linux kernel before 2.6.22, when the xfrm6_tunnel module is enabled, allows remote attackers to cause a denial of service (panic) via crafted IPv6 packets.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Weakness information:
cwe_id: CWE-399
cwe_name: Resource Management Errors
description: Weaknesses in this category are related to improper management of system resources.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Eric Sesterhenn
author_date: 2007-04-28 21:26:23-07:00
msg: [IPV6]: Fix slab corruption running ip6sic

From: Eric Sesterhenn <snakebyte@gmx.de>

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: xfrm6_tunnel.c
change_type: ModificationType.MODIFY
diff: @@ -261,7 +261,7 @@ static int xfrm6_tunnel_rcv(struct sk_buff *skb)
 	__be32 spi;
 
 	spi = xfrm6_tunnel_spi_lookup((xfrm_address_t *)&iph->saddr);
-	return xfrm6_rcv_spi(skb, spi);
+	return xfrm6_rcv_spi(skb, spi) > 0 ? : 0;
 }
 
 static int xfrm6_tunnel_err(struct sk_buff *skb, struct inet6_skb_parm *opt,

programming_language: C
CVE-2024-27319 (published 2024-02-23T18:15Z)

Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions have an off by one string copy.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/onnx/onnx
commit_details: repo_url: https://github.com/onnx/onnx
author: liqun Fu
author_date: 2024-02-09 14:45:49-08:00
msg: Fix Out of bounds read due to lack of string termination in assert (#5918)

Signed-off-by: liqunfu <liqun.fu@microsoft.com>
Co-authored-by: G. Ramalingam <grama@microsoft.com>
repository: repo_url: https://github.com/onnx/onnx
repo_name: onnx/onnx
description: Open standard for machine learning interoperability
repo_language: Python
owner: onnx
file_changes: filename: assertions.cc
change_type: ModificationType.MODIFY
diff: @@ -9,6 +9,7 @@
 
 #include "onnx/common/assertions.h"
 
+#include <array>
 #include <cstdarg>
 #include <cstdio>
 
@@ -17,16 +18,20 @@
 namespace ONNX_NAMESPACE {
 
 std::string barf(const char* fmt, ...) {
-  char msg[2048];
+  constexpr size_t buffer_size = 2048;
+  std::array<char, buffer_size> msg{};
   va_list args;
 
   va_start(args, fmt);
-  // Although vsnprintf might have vulnerability issue while using format string with overflowed length,
-  // it should be safe here to use fixed length for buffer "msg". No further checking is needed.
-  vsnprintf(msg, 2048, fmt, args);
+
+  // use fixed length for buffer "msg" to avoid buffer overflow
+  vsnprintf(static_cast<char*>(msg.data()), msg.size() - 1, fmt, args);
+
+  // ensure null-terminated string to avoid out of bounds read
+  msg.back() = '\0';
   va_end(args);
 
-  return std::string(msg);
+  return std::string(msg.data());
 }
 
 void throw_assert_error(std::string& msg) {

programming_language: C++
CVE-2023-37188 (published 2023-12-25T07:15Z)

C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_rate_decompress at zfp/blosc2-zfp.c.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/Blosc/c-blosc2
commit_details: repo_url: https://github.com/Blosc/c-blosc2
author: Marta Iborra
author_date: 2023-06-21 11:16:28+02:00
msg: Fix for #519 #520 #521
repository: repo_url: https://github.com/Blosc/c-blosc2
repo_name: Blosc/c-blosc2
description: A fast, compressed, persistent binary data store library for C.
repo_language: C
owner: Blosc
file_changes: filename: blosc2-zfp.c
change_type: ModificationType.MODIFY
diff: @@ -26,6 +26,7 @@ int zfp_acc_compress(const uint8_t *input, int32_t input_len, uint8_t *output,
   ZFP_ERROR_NULL(input);
   ZFP_ERROR_NULL(output);
   ZFP_ERROR_NULL(cparams);
+  ZFP_ERROR_NULL(cparams->schunk);
 
   double tol = (int8_t) meta;
   int8_t ndim;
@@ -146,6 +147,7 @@ int zfp_acc_decompress(const uint8_t *input, int32_t input_len, uint8_t *output,
   ZFP_ERROR_NULL(input);
   ZFP_ERROR_NULL(output);
   ZFP_ERROR_NULL(dparams);
+  ZFP_ERROR_NULL(dparams->schunk);
   BLOSC_UNUSED_PARAM(chunk);
 
   blosc2_schunk *sc = dparams->schunk;
@@ -241,6 +243,7 @@ int zfp_prec_compress(const uint8_t *input, int32_t input_len, uint8_t *output,
   ZFP_ERROR_NULL(input);
   ZFP_ERROR_NULL(output);
   ZFP_ERROR_NULL(cparams);
+  ZFP_ERROR_NULL(cparams->schunk);
 
   int8_t ndim;
   int64_t *shape = malloc(8 * sizeof(int64_t));
@@ -385,6 +388,7 @@ int zfp_prec_decompress(const uint8_t *input, int32_t input_len, uint8_t *output
   ZFP_ERROR_NULL(input);
   ZFP_ERROR_NULL(output);
   ZFP_ERROR_NULL(dparams);
+  ZFP_ERROR_NULL(dparams->schunk);
   BLOSC_UNUSED_PARAM(chunk);
 
   blosc2_schunk *sc = dparams->schunk;
@@ -504,6 +508,7 @@ int zfp_rate_compress(const uint8_t *input, int32_t input_len, uint8_t *output,
   ZFP_ERROR_NULL(input);
   ZFP_ERROR_NULL(output);
   ZFP_ERROR_NULL(cparams);
+  ZFP_ERROR_NULL(cparams->schunk);
 
   double ratio = (double) meta / 100.0;
   int8_t ndim;
@@ -635,6 +640,7 @@ int zfp_rate_decompress(const uint8_t *input, int32_t input_len, uint8_t *output
   ZFP_ERROR_NULL(input);
   ZFP_ERROR_NULL(output);
   ZFP_ERROR_NULL(dparams);
+  ZFP_ERROR_NULL(dparams->schunk);
   BLOSC_UNUSED_PARAM(chunk);
 
   blosc2_schunk *sc = dparams->schunk;

programming_language: C
CVE-2017-5549 (published 2017-02-06T06:59Z)

The klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c in the Linux kernel before 4.9.5 places uninitialized heap-memory contents into a log entry upon a failure to read the line status, which allows local users to obtain sensitive information by reading the log.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-532
cwe_name: Insertion of Sensitive Information into Log File
description: Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
extended_description: 
            While logging all information may be helpful during development stages, it is important that logging levels be set appropriately before a product ships so that sensitive user data and system information are not accidentally exposed to potential attackers.
            Different log files may be produced and stored for:
            
               Server log files (e.g. server.log).  This can give information on whatever application left the file. Usually this can give full path names and system information, and sometimes usernames and passwords.
               log files that are used for debugging
            
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Johan Hovold
author_date: 2017-01-10 12:05:37+01:00
msg: USB: serial: kl5kusb105: fix line-state error handling

The current implementation failed to detect short transfers when
attempting to read the line state, and also, to make things worse,
logged the content of the uninitialised heap transfer buffer.

Fixes: abf492e7b3ae ("USB: kl5kusb105: fix DMA buffers on stack")
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable <stable@vger.kernel.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: kl5kusb105.c
change_type: ModificationType.MODIFY
diff: @@ -192,10 +192,11 @@ static int klsi_105_get_line_state(struct usb_serial_port *port,
 			     status_buf, KLSI_STATUSBUF_LEN,
 			     10000
 			     );
-	if (rc < 0)
-		dev_err(&port->dev, "Reading line status failed (error = %d)\n",
-			rc);
-	else {
+	if (rc != KLSI_STATUSBUF_LEN) {
+		dev_err(&port->dev, "reading line status failed: %d\n", rc);
+		if (rc >= 0)
+			rc = -EIO;
+	} else {
 		status = get_unaligned_le16(status_buf);
 
 		dev_info(&port->serial->dev->dev, "read status %x %x\n",

programming_language: C
CVE-2023-24812 (published 2023-02-22T20:15Z)

Misskey is an open source, decentralized social media platform. In versions prior to 13.3.3 SQL injection is possible due to insufficient parameter validation in the note search API by tag (notes/search-by-tag). This has been fixed in version 13.3.3. Users are advised to upgrade. Users unable to upgrade should block access to the `api/notes/search-by-tag` endpoint.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/misskey-dev/misskey
commit_details: repo_url: https://github.com/misskey-dev/misskey
author: syuilo
author_date: 2023-02-04 18:21:07+09:00
msg: fix(server): improve security
repository: repo_url: https://github.com/misskey-dev/misskey
repo_name: misskey-dev/misskey
description: 🌎 An interplanetary microblogging platform 🚀
repo_language: TypeScript
owner: misskey-dev
file_changes: filename: search-by-tag.ts
change_type: ModificationType.MODIFY
diff: @@ -95,14 +95,14 @@ export default class extends Endpoint<typeof meta, typeof paramDef> {
 
 			try {
 				if (ps.tag) {
-					if (!safeForSql(ps.tag)) throw 'Injection';
+					if (!safeForSql(normalizeForSearch(ps.tag))) throw 'Injection';
 					query.andWhere(`'{"${normalizeForSearch(ps.tag)}"}' <@ note.tags`);
 				} else {
 					query.andWhere(new Brackets(qb => {
 						for (const tags of ps.query!) {
 							qb.orWhere(new Brackets(qb => {
 								for (const tag of tags) {
-									if (!safeForSql(tag)) throw 'Injection';
+									if (!safeForSql(normalizeForSearch(tag))) throw 'Injection';
 									qb.andWhere(`'{"${normalizeForSearch(tag)}"}' <@ note.tags`);
 								}
 							}));

programming_language: TypeScript
CVE-2015-8660 (published 2015-12-28T11:59Z)

The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 6.7, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Miklos Szeredi
author_date: 2015-12-04 19:18:48+01:00
msg: ovl: fix permission checking for setattr

[Al Viro] The bug is in being too enthusiastic about optimizing ->setattr()
away - instead of "copy verbatim with metadata" + "chmod/chown/utimes"
(with the former being always safe and the latter failing in case of
insufficient permissions) it tries to combine these two.  Note that copyup
itself will have to do ->setattr() anyway; _that_ is where the elevated
capabilities are right.  Having these two ->setattr() (one to set verbatim
copy of metadata, another to do what overlayfs ->setattr() had been asked
to do in the first place) combined is where it breaks.

Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Cc: <stable@vger.kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: inode.c
change_type: ModificationType.MODIFY
diff: @@ -49,13 +49,13 @@ int ovl_setattr(struct dentry *dentry, struct iattr *attr)
 	if (err)
 		goto out;
 
-	upperdentry = ovl_dentry_upper(dentry);
-	if (upperdentry) {
+	err = ovl_copy_up(dentry);
+	if (!err) {
+		upperdentry = ovl_dentry_upper(dentry);
+
 		mutex_lock(&upperdentry->d_inode->i_mutex);
 		err = notify_change(upperdentry, attr, NULL);
 		mutex_unlock(&upperdentry->d_inode->i_mutex);
-	} else {
-		err = ovl_copy_up_last(dentry, attr, false);
 	}
 	ovl_drop_write(dentry);
 out:

programming_language: C
CVE-2013-4451 (published 2018-09-21T17:29Z)

gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving world-writable permissions when creating (1) ~/.gitolite.rc, (2) ~/.gitolite, or (3) ~/repositories/gitolite-admin.git on fresh installs.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/sitaramc/gitolite
commit_details: repo_url: https://github.com/sitaramc/gitolite
author: Sitaram Chamarty
author_date: 2013-10-21 07:01:11+05:30
msg: oops; fa06a34 had a nasty bug for fresh installs

thanks to Nathan Ferch for catching this.  See thread with subject line "World
writable files and directories" on the mailing list.
repository: repo_url: https://github.com/sitaramc/gitolite
repo_name: sitaramc/gitolite
description: Hosting git repositories -- Gitolite allows you to setup git hosting on a central server, with very fine-grained access control and many (many!) more powerful features.
repo_language: Perl
owner: sitaramc
file_changes: filename: Rc.pm
change_type: ModificationType.MODIFY
diff: @@ -93,7 +93,7 @@ do $ENV{G3T_RC} if exists $ENV{G3T_RC} and -r $ENV{G3T_RC};
 # setup some perl/rc/env vars, plus umask
 # ----------------------------------------------------------------------
 
-umask $rc{UMASK};
+umask ( $rc{UMASK} || 0077 );
 
 unshift @INC, "$rc{LOCAL_CODE}/lib" if $rc{LOCAL_CODE};
 

programming_language: Perl