starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2024-28861 (published 2024-03-22T17:15Z)

Symfony 1 is a community-driven fork of the 1.x branch of Symfony, a PHP framework for web projects. Starting in version 1.1.0 and prior to version 1.5.19, Symfony 1 has a gadget chain due to dangerous deserialization in `sfNamespacedParameterHolder` class that would enable an attacker to get remote code execution if a developer deserializes user input in their project. Version 1.5.19 contains a patch for the issue.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/FriendsOfSymfony1/symfony1
commit_details: repo_url: https://github.com/FriendsOfSymfony1/symfony1
author: darkpills
author_date: 2024-03-01 09:56:09+01:00
msg: Hotfix: Add type checking for deserialized data in sfParameterHolder and sfNamespacedParameterHolder (CVE-2024-28861)
repository: repo_url: https://github.com/FriendsOfSymfony1/symfony1
repo_name: FriendsOfSymfony1/symfony1
description: [DEPRECATED -- Use Symfony instead] Fork of symfony 1.4 with DIC, form enhancements, latest Swiftmailer, better performance, composer compatible and PHP 8 support
repo_language: PHP
owner: FriendsOfSymfony1
file_changes: filename: sfNamespacedParameterHolder.class.php
change_type: ModificationType.MODIFY
diff: @@ -53,11 +53,19 @@ class sfNamespacedParameterHolder extends sfParameterHolder
 
     /**
      * Unserializes a sfParameterHolder instance for PHP 7.4+.
+     * [CVE-2024-28861] Check type of returned data to avoid deserialization vulnerabilities.
      *
      * @param array $data
      */
     public function __unserialize($data)
     {
+        if (!is_array($data) || 2 !== \count($data)) {
+            $this->default_namespace = null;
+            $this->parameters = [];
+
+            return;
+        }
+
         $this->default_namespace = $data[0];
         $this->parameters = $data[1];
     }

programming_language: PHP
filename: sfParameterHolder.class.php
change_type: ModificationType.MODIFY
diff: @@ -41,11 +41,18 @@ class sfParameterHolder implements Serializable
 
     /**
      * Unserializes a sfParameterHolder instance for PHP 7.4+.
+     * [CVE-2024-28861] Check type of returned data to avoid deserialization vulnerabilities.
      *
      * @param array $data
      */
     public function __unserialize($data)
     {
+        if (!is_array($data)) {
+            $this->parameters = [];
+
+            return;
+        }
+
         $this->parameters = $data;
     }
 

programming_language: PHP
CVE-2021-37661 (published 2021-08-12T21:15Z)

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can cause a denial of service in `boosted_trees_create_quantile_stream_resource` by using negative arguments. The [implementation](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/boosted_trees/quantile_ops.cc#L96) does not validate that `num_streams` only contains non-negative numbers. In turn, [this results in using this value to allocate memory](https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/boosted_trees/quantiles/quantile_stream_resource.h#L31-L40). However, `reserve` receives an unsigned integer so there is an implicit conversion from a negative value to a large positive unsigned. This results in a crash from the standard library. We have patched the issue in GitHub commit 8a84f7a2b5a2b27ecf88d25bad9ac777cd2f7992. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-681
cwe_name: Incorrect Conversion between Numeric Types
description: When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Laura Pak
author_date: 2021-07-28 15:34:04-07:00
msg: Ensure num_streams >= 0 in tf.raw_ops.BoostedTreesCreateQuantileStreamResource

PiperOrigin-RevId: 387452765
Change-Id: I9990c760e177fabca6a3b9b4612ceeaeeba51495
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: quantile_ops.cc
change_type: ModificationType.MODIFY
diff: @@ -116,6 +116,9 @@ class BoostedTreesCreateQuantileStreamResourceOp : public OpKernel {
     const Tensor* num_streams_t;
     OP_REQUIRES_OK(context, context->input(kNumStreamsName, &num_streams_t));
     int64_t num_streams = num_streams_t->scalar<int64>()();
+    OP_REQUIRES(context, num_streams >= 0,
+                errors::InvalidArgument(
+                    "Num_streams input cannot be a negative integer"));
 
     auto result =
         new QuantileStreamResource(epsilon, max_elements_, num_streams);

programming_language: C++
CVE-2023-25654 (published 2023-03-23T20:15Z)

baserCMS is a Content Management system. Prior to version 4.7.5, there is a Remote Code Execution (RCE) Vulnerability in the management system of baserCMS. Version 4.7.5 contains a patch.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/baserproject/basercms
commit_details: repo_url: https://github.com/baserproject/basercms
author: gondoh
author_date: 2023-02-27 17:25:17+09:00
msg: fix CVE-2023-25654

ファイル更新時のValidationを改善
repository: repo_url: https://github.com/baserproject/basercms
repo_name: baserproject/basercms
description: baserCMS :  Based Website Development Project
repo_language: PHP
owner: baserproject
file_changes: filename: BcAppModel.php
change_type: ModificationType.MODIFY
diff: @@ -932,14 +932,22 @@ class BcAppModel extends Model
 	public function fileExt($check, $exts)
 	{
 		$file = $check[key($check)];
+		if (!is_array($exts)) {
+			$exts = explode(',', $exts);
+		}
+
+		// FILES形式のチェック
 		if (!empty($file['name'])) {
-			if (!is_array($exts)) {
-				$exts = explode(',', $exts);
-			}
 			$ext = decodeContent($file['type'], $file['name']);
-			if (in_array($ext, $exts)) {
-				return true;
-			} else {
+			if (!in_array($ext, $exts)) {
+				return false;
+			}
+		}
+
+		// 更新時の文字列チェック
+		if (is_string($file)) {
+			$ext = pathinfo($file, PATHINFO_EXTENSION);
+			if (!in_array($ext, $exts)) {
 				return false;
 			}
 		}

programming_language: PHP
repo_url: https://github.com/baserproject/basercms
commit_details: repo_url: https://github.com/baserproject/basercms
author: gondoh
author_date: 2023-03-10 13:56:48+09:00
msg: fix CVE-2023-25654

戻り値が変更されてしまう挙動を修正
repository: repo_url: https://github.com/baserproject/basercms
repo_name: baserproject/basercms
description: baserCMS :  Based Website Development Project
repo_language: PHP
owner: baserproject
file_changes: filename: BcAppModel.php
change_type: ModificationType.MODIFY
diff: @@ -945,7 +945,7 @@ class BcAppModel extends Model
 		}
 
 		// 更新時の文字列チェック
-		if (is_string($file)) {
+		if (!empty($file) && is_string($file)) {
 			$ext = pathinfo($file, PATHINFO_EXTENSION);
 			if (!in_array($ext, $exts)) {
 				return false;

programming_language: PHP
repo_url: https://github.com/baserproject/basercms
commit_details: repo_url: https://github.com/baserproject/basercms
author: ゴンドー
author_date: 2023-03-23 16:14:23+09:00
msg: Merge pull request from GHSA-h4cc-fxpp-pgw9

fix CVE-2023-25654
repository: repo_url: https://github.com/baserproject/basercms
repo_name: baserproject/basercms
description: baserCMS :  Based Website Development Project
repo_language: PHP
owner: baserproject
CVE-2019-1010062 (published 2019-07-16T13:15Z)

PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type. The impact is: get webshell. The component is: data/inc/images.php line36. The attack vector is: modify the MIME TYPE on HTTP request to upload a php file. The fixed version is: after commit 09f0ab871bf633973cfd9fc4fe59d4a912397cf8.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/pluck-cms/pluck
commit_details: repo_url: https://github.com/pluck-cms/pluck
author: Bas S
author_date: 2018-04-08 13:11:39+02:00
msg: Fix issue #44. Thanks to Klaus.
repository: repo_url: https://github.com/pluck-cms/pluck
repo_name: pluck-cms/pluck
description: Central repo for pluck cms
repo_language: PHP
owner: pluck-cms
file_changes: filename: images.php
change_type: ModificationType.MODIFY
diff: @@ -34,9 +34,13 @@ defined('IN_PLUCK') or exit('Access denied!');
 if (isset($_POST['submit'])) {
 	//Check if the file is JPG, PNG or GIF.
 	if (in_array($_FILES['imagefile']['type'], array('image/pjpeg', 'image/jpeg','image/png', 'image/gif'))) {
+		/* fix issue 44. Thanks to Klaus.  */
+        $imagewhitelist = array('jfif', '.png', '.jpg', '.gif', 'jpeg');  
+        if (!in_array(strtolower(substr($_FILES['imagefile']['name'], -4)), $imagewhitelist))
+			show_error($lang['general']['upload_failed'], 1);
+		/* end of fix issue 44. Thanks to Klaus.  */
 		if (!copy($_FILES['imagefile']['tmp_name'], 'images/'.$_FILES['imagefile']['name']))
 			show_error($lang['general']['upload_failed'], 1);
-
 		else {
 			chmod('images/'.$_FILES['imagefile']['name'], 0666);
 			?>

programming_language: PHP
CVE-2021-37654 (published 2021-08-12T21:15Z)

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a crash via a `CHECK`-fail in debug builds of TensorFlow using `tf.raw_ops.ResourceGather` or a read from outside the bounds of heap allocated data in the same API in a release build. The [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/resource_variable_ops.cc#L660-L668) does not check that the `batch_dims` value that the user supplies is less than the rank of the input tensor. Since the implementation uses several for loops over the dimensions of `tensor`, this results in reading data from outside the bounds of heap allocated buffer backing the tensor. We have patched the issue in GitHub commit bc9c546ce7015c57c2f15c168b3d9201de679a1d. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

Severity: LOW
CVSS v2 base score: 3.6 (AV:L/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2021-07-30 21:37:59-07:00
msg: Prevent heap oob access in `resource_variable_ops.cc`

PiperOrigin-RevId: 387936433
Change-Id: I9e71ddaa8dbd51ec6afbf163a6b3b591f193b4f6
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: resource_variable_ops.cc
change_type: ModificationType.MODIFY
diff: @@ -660,6 +660,11 @@ class ResourceGatherOp : public OpKernel {
     OP_REQUIRES(
         c, TensorShapeUtils::IsVectorOrHigher(params.shape()),
         errors::InvalidArgument("params must be at least 1 dimensional"));
+    OP_REQUIRES(
+        c, params.shape().dims() >= batch_dims_,
+        errors::InvalidArgument("params must have at least ", batch_dims_,
+                                " (batch_dims) dimensions but it has shape ",
+                                params.shape().DebugString()));
 
     // Check that we have enough index space
     const int64_t N = indices.NumElements();

programming_language: C++
CVE-2021-21371 (published 2021-03-10T22:15Z)

Tenable for Jira Cloud is an open source project designed to pull Tenable.io vulnerability data, then generate Jira Tasks and sub-tasks based on the vulnerabilities\' current state. It published in pypi as "tenable-jira-cloud". In tenable-jira-cloud before version 1.1.21, it is possible to run arbitrary commands through the yaml.load() method. This could allow an attacker with local access to the host to run arbitrary code by running the application with a specially crafted YAML configuration file. This is fixed in version 1.1.21 by using yaml.safe_load() instead of yaml.load().

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.6, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-502
cwe_name: Deserialization of Untrusted Data
description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
extended_description: 
            It is often convenient to serialize objects for communication or to save them for later use. However, deserialized data or code can often be modified without using the provided accessor functions if it does not use cryptography to protect itself. Furthermore, any cryptography would still be client-side security -- which is a dangerous security assumption.
            Data that is untrusted can not be trusted to be well-formed.
            When developers place no restrictions on "gadget chains," or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions, like generating a shell.
         
         

Fix information:
repo_url: https://github.com/tenable/integration-jira-cloud
commit_details: repo_url: https://github.com/tenable/integration-jira-cloud
author: Steve McGrath
author_date: 2021-03-04 08:58:38-06:00
msg: switched yaml.load() to yaml.safe_load() to not load serialized python objects.
repository: repo_url: https://github.com/tenable/integration-jira-cloud
repo_name: tenable/integration-jira-cloud
repo_language: Python
owner: tenable
file_changes: filename: cli.py
change_type: ModificationType.MODIFY
diff: @@ -62,7 +62,7 @@ def cli(configfile, observed_since, setup_only=False, troubleshoot=False):
     '''
     # Load the config, but ensure that any additional fields are additive to the
     # basic field set.
-    config_from_file = yaml.load(configfile, Loader=yaml.Loader)
+    config_from_file = yaml.safe_load(configfile)
     fields = config_from_file.pop('custom_fields', list())
     config = dict_merge(base_config(), config_from_file)
     config['fields'] = config['fields'] + fields

programming_language: Python
CVE-2020-14405 (published 2020-06-17T16:15Z)

An issue was discovered in LibVNCServer before 0.9.13. libvncclient/rfbproto.c does not limit TextChat size.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-770
cwe_name: Allocation of Resources Without Limits or Throttling
description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
extended_description: Code frequently has to work with limited resources, so programmers must be careful to ensure that resources are not consumed too quickly, or too easily.  Without use of quotas, resource limits, or other protection mechanisms, it can be easy for an attacker to consume many resources by rapidly making many requests, or causing larger resources to be used than is needed. When too many resources are allocated, or if a single resource is too large, then it can prevent the code from working correctly, possibly leading to a denial of service.
         

Fix information:
repo_url: https://github.com/LibVNC/libvncserver
commit_details: repo_url: https://github.com/LibVNC/libvncserver
author: Christian Beier
author_date: 2020-04-10 19:07:12+02:00
msg: libvncclient/rfbproto: limit max textchat size

Addresses GitHub Security Lab (GHSL) Vulnerability Report
`GHSL-2020-063`.

Re #275
repository: repo_url: https://github.com/LibVNC/libvncserver
repo_name: LibVNC/libvncserver
description: LibVNCServer/LibVNCClient are cross-platform C libraries that allow you to easily implement VNC server or client functionality in your program.
repo_language: C
owner: LibVNC
file_changes: filename: rfbproto.c
change_type: ModificationType.MODIFY
diff: @@ -65,6 +65,7 @@
 #endif
 #include "tls.h"
 
+#define MAX_TEXTCHAT_SIZE 10485760 /* 10MB */
 
 /*
  * rfbClientLog prints a time-stamped message to the log file (stderr).
@@ -2159,6 +2160,8 @@ HandleRFBServerMessage(rfbClient* client)
               client->HandleTextChat(client, (int)rfbTextChatFinished, NULL);
           break;
       default:
+	  if(msg.tc.length > MAX_TEXTCHAT_SIZE)
+	      return FALSE;
           buffer=malloc(msg.tc.length+1);
           if (!ReadFromRFBServer(client, buffer, msg.tc.length))
           {

programming_language: C
CVE-2013-7027 (published 2013-12-09T18:55Z)

The ieee80211_radiotap_iterator_init function in net/wireless/radiotap.c in the Linux kernel before 3.11.7 does not check whether a frame contains any data outside of the header, which might allow attackers to cause a denial of service (buffer over-read) via a crafted header.

Severity: MEDIUM
CVSS v2 base score: 6.1 (AV:A/AC:L/Au:N/C:N/I:N/A:C)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Johannes Berg
author_date: 2013-10-11 14:47:05+02:00
msg: wireless: radiotap: fix parsing buffer overrun

When parsing an invalid radiotap header, the parser can overrun
the buffer that is passed in because it doesn't correctly check
 1) the minimum radiotap header size
 2) the space for extended bitmaps

The first issue doesn't affect any in-kernel user as they all
check the minimum size before calling the radiotap function.
The second issue could potentially affect the kernel if an skb
is passed in that consists only of the radiotap header with a
lot of extended bitmaps that extend past the SKB. In that case
a read-only buffer overrun by at most 4 bytes is possible.

Fix this by adding the appropriate checks to the parser.

Cc: stable@vger.kernel.org
Reported-by: Evan Huus <eapache@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: radiotap.c
change_type: ModificationType.MODIFY
diff: @@ -97,6 +97,10 @@ int ieee80211_radiotap_iterator_init(
 	struct ieee80211_radiotap_header *radiotap_header,
 	int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns)
 {
+	/* check the radiotap header can actually be present */
+	if (max_length < sizeof(struct ieee80211_radiotap_header))
+		return -EINVAL;
+
 	/* Linux only supports version 0 radiotap format */
 	if (radiotap_header->it_version)
 		return -EINVAL;
@@ -131,7 +135,8 @@ int ieee80211_radiotap_iterator_init(
 			 */
 
 			if ((unsigned long)iterator->_arg -
-			    (unsigned long)iterator->_rtheader >
+			    (unsigned long)iterator->_rtheader +
+			    sizeof(uint32_t) >
 			    (unsigned long)iterator->_max_length)
 				return -EINVAL;
 		}

programming_language: C