sample_cpp.csv

Unnamed: 0,authentication_required,availability_impact,cve_id,cve_page,cwe_id,access_complexity,confidentiality_impact,integrity_impact,publish_date,score,summary,update_date,vulnerability_classification,ref_link,commit_id,commit_message,files_changed,lang,project,version_after_fix,version_before_fix
0,Not required,Partial,CVE-2009-1194,https://www.cvedetails.com/cve/CVE-2009-1194/,CWE-189,Medium,Partial,Partial,2009-05-11,6.8,"Integer overflow in the pango_glyph_string_set_size function in pango/glyphstring.c in Pango before 1.24 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long glyph string that triggers a heap-based buffer overflow, as demonstrated by a long document.location value in Firefox.",2018-10-10,DoS Exec Code Overflow ,https://github.com/bratsche/pango/commit/4de30e5500eaeb49f4bf0b7a07f718e149a2ed5e,4de30e5500eaeb49f4bf0b7a07f718e149a2ed5e,[glyphstring] Handle overflow with very long glyphstrings,"{""sha"": ""8fb70313eb8835dcce812a86209e2a7d88457795"", ""filename"": ""pango/glyphstring.c"", ""status"": ""modified"", ""additions"": 20, ""deletions"": 6, ""changes"": 26, ""blob_url"": ""https://github.com/bratsche/pango/blob/4de30e5500eaeb49f4bf0b7a07f718e149a2ed5e/pango/glyphstring.c"", ""raw_url"": ""https://github.com/bratsche/pango/raw/4de30e5500eaeb49f4bf0b7a07f718e149a2ed5e/pango/glyphstring.c"", ""contents_url"": ""https://api.github.com/repos/bratsche/pango/contents/pango/glyphstring.c?ref=4de30e5500eaeb49f4bf0b7a07f718e149a2ed5e"", ""patch"": ""@@ -61,14 +61,28 @@ pango_glyph_string_set_size (PangoGlyphString *string, gint new_len)\n   while (new_len > string->space)\n     {\n       if (string->space == 0)\n-\tstring->space = 1;\n+\t{\n+\t  string->space = 4;\n+\t}\n       else\n-\tstring->space *= 2;\n-\n-      if (string->space < 0)\n \t{\n-\t  g_warning (\""glyph string length overflows maximum integer size, truncated\"");\n-\t  new_len = string->space = G_MAXINT - 8;\n+\t  const guint max_space =\n+\t    MIN (G_MAXINT, G_MAXSIZE / MAX (sizeof(PangoGlyphInfo), sizeof(gint)));\n+\n+\t  guint more_space = (guint)string->space * 2;\n+\n+\t  if (more_space > max_space)\n+\t    {\n+\t      more_space = max_space;\n+\n+\t      if ((guint)new_len > max_space)\n+\t\t{\n+\t\t  g_error (\""%s: failed to allocate glyph string of length %i\\n\"",\n+\t\t\t   G_STRLOC, new_len);\n+\t\t}\n+\t    }\n+\n+\t  string->space = more_space;\n \t}\n     }\n ""}",C,pango,4de30e5500eaeb49f4bf0b7a07f718e149a2ed5e,1c9433bfe43890b102c8cead8ab3ee34b44c5c37
1,Not required,Partial,CVE-2010-2809,https://www.cvedetails.com/cve/CVE-2010-2809/,CWE-94,Medium,Partial,Partial,2010-08-19,6.8,"The default configuration of the <Button2> binding in Uzbl before 2010.08.05 does not properly use the @SELECTED_URI feature, which allows user-assisted remote attackers to execute arbitrary commands via a crafted HREF attribute of an A element in an HTML document.",2017-08-16,Exec Code ,https://github.com/Dieterbe/uzbl/commit/9cc39cb5c9396be013b5dc2ba7e4b3eaa647e975,9cc39cb5c9396be013b5dc2ba7e4b3eaa647e975,Don't shell-interpret \@SELECTED_URI (fixes FS#240),"{""sha"": ""da2c583dc09acf7eb567df6c9c629e61f3c80fa3"", ""filename"": ""examples/config/config"", ""status"": ""modified"", ""additions"": 1, ""deletions"": 1, ""changes"": 2, ""blob_url"": ""https://github.com/uzbl/uzbl/blob/9cc39cb5c9396be013b5dc2ba7e4b3eaa647e975/examples/config/config"", ""raw_url"": ""https://github.com/uzbl/uzbl/raw/9cc39cb5c9396be013b5dc2ba7e4b3eaa647e975/examples/config/config"", ""contents_url"": ""https://api.github.com/repos/uzbl/uzbl/contents/examples/config/config?ref=9cc39cb5c9396be013b5dc2ba7e4b3eaa647e975"", ""patch"": ""@@ -173,7 +173,7 @@ set ebind     = @mode_bind global,-insert\n # --- Mouse bindings ---------------------------------------------------------\n \n # Middle click open in new window\n-@bind  <Button2>  = sh 'if [ \""\\@SELECTED_URI\"" ]; then uzbl-browser -u \""\\@SELECTED_URI\""; else echo \""uri $(xclip -o | sed s/\\\\\\@/%40/g)\"" > $4; fi'\n+@bind  <Button2>  = sh 'if [ \""$8\"" ]; then uzbl-browser -u \""$8\""; else echo \""uri $(xclip -o | sed s/\\\\\\@/%40/g)\"" > $4; fi' \\@SELECTED_URI\n \n # --- Keyboard bindings ------------------------------------------------------\n ""}",C,uzbl,9cc39cb5c9396be013b5dc2ba7e4b3eaa647e975,afc0f873e873839da75a54e8ca8095d335527786
2,Not required,Partial,CVE-2010-2060,https://www.cvedetails.com/cve/CVE-2010-2060/,,Low,Partial,Partial,2010-06-07,7.5,"The put command functionality in beanstalkd 1.4.5 and earlier allows remote attackers to execute arbitrary Beanstalk commands via the body in a job that is too big, which is not properly handled by the dispatch_cmd function in prot.c.",2017-08-16,Exec Code ,https://github.com/kr/beanstalkd/commit/2e8e8c6387ecdf5923dfc4d7718d18eba1b0873d,2e8e8c6387ecdf5923dfc4d7718d18eba1b0873d,"Discard job body bytes if the job is too big.

Previously, a malicious user could craft a job payload and inject
beanstalk commands without the client application knowing. (An
extra-careful client library could check the size of the job body before
sending the put command, but most libraries do not do this, nor should
they have to.)

Reported by Graham Barr.","{""sha"": ""bcfb7d4b22c28d3f909d13dad54b4caa1284fdbe"", ""filename"": ""check-one.sh"", ""status"": ""modified"", ""additions"": 1, ""deletions"": 1, ""changes"": 2, ""blob_url"": ""https://github.com/beanstalkd/beanstalkd/blob/2e8e8c6387ecdf5923dfc4d7718d18eba1b0873d/check-one.sh"", ""raw_url"": ""https://github.com/beanstalkd/beanstalkd/raw/2e8e8c6387ecdf5923dfc4d7718d18eba1b0873d/check-one.sh"", ""contents_url"": ""https://api.github.com/repos/beanstalkd/beanstalkd/contents/check-one.sh?ref=2e8e8c6387ecdf5923dfc4d7718d18eba1b0873d"", ""patch"": ""@@ -34,7 +34,7 @@ if [ ! -x ./beanstalkd ]; then\n   exit 2\n fi\n \n-start_beanstalkd\n+start_beanstalkd '' '-z 10'\n \n # Run the test\n fgrep -v \""#\"" $commands | $nc $server $port > \""$tmpf\""""}<_**next**_>{""sha"": ""481b0ede2231a7ca5a010665a4f34d55702757d7"", ""filename"": ""prot.c"", ""status"": ""modified"", ""additions"": 2, ""deletions"": 1, ""changes"": 3, ""blob_url"": ""https://github.com/beanstalkd/beanstalkd/blob/2e8e8c6387ecdf5923dfc4d7718d18eba1b0873d/prot.c"", ""raw_url"": ""https://github.com/beanstalkd/beanstalkd/raw/2e8e8c6387ecdf5923dfc4d7718d18eba1b0873d/prot.c"", ""contents_url"": ""https://api.github.com/repos/beanstalkd/beanstalkd/contents/prot.c?ref=2e8e8c6387ecdf5923dfc4d7718d18eba1b0873d"", ""patch"": ""@@ -1196,7 +1196,8 @@ dispatch_cmd(conn c)\n         if (errno) return reply_msg(c, MSG_BAD_FORMAT);\n \n         if (body_size > job_data_size_limit) {\n-            return reply_msg(c, MSG_JOB_TOO_BIG);\n+            /* throw away the job body and respond with JOB_TOO_BIG */\n+            return skip(c, body_size + 2, MSG_JOB_TOO_BIG);\n         }\n \n         /* don't allow trailing garbage */""}<_**next**_>{""sha"": ""d85cd39970163a16162d9b089637393e8ee1a338"", ""filename"": ""sh-tests/too-big.commands"", ""status"": ""added"", ""additions"": 3, ""deletions"": 0, ""changes"": 3, ""blob_url"": ""https://github.com/beanstalkd/beanstalkd/blob/2e8e8c6387ecdf5923dfc4d7718d18eba1b0873d/sh-tests/too-big.commands"", ""raw_url"": ""https://github.com/beanstalkd/beanstalkd/raw/2e8e8c6387ecdf5923dfc4d7718d18eba1b0873d/sh-tests/too-big.commands"", ""contents_url"": ""https://api.github.com/repos/beanstalkd/beanstalkd/contents/sh-tests/too-big.commands?ref=2e8e8c6387ecdf5923dfc4d7718d18eba1b0873d"", ""patch"": ""@@ -0,0 +1,3 @@\n+put 0 0 0 11\r\n+delete 9999\r\n+quit\r""}<_**next**_>{""sha"": ""88448bcd35862097ac4a2c0281b1b1f3a446a7ba"", ""filename"": ""sh-tests/too-big.expected"", ""status"": ""added"", ""additions"": 1, ""deletions"": 0, ""changes"": 1, ""blob_url"": ""https://github.com/beanstalkd/beanstalkd/blob/2e8e8c6387ecdf5923dfc4d7718d18eba1b0873d/sh-tests/too-big.expected"", ""raw_url"": ""https://github.com/beanstalkd/beanstalkd/raw/2e8e8c6387ecdf5923dfc4d7718d18eba1b0873d/sh-tests/too-big.expected"", ""contents_url"": ""https://api.github.com/repos/beanstalkd/beanstalkd/contents/sh-tests/too-big.expected?ref=2e8e8c6387ecdf5923dfc4d7718d18eba1b0873d"", ""patch"": ""@@ -0,0 +1 @@\n+JOB_TOO_BIG\r""}",C,beanstalkd,2e8e8c6387ecdf5923dfc4d7718d18eba1b0873d,62328a506b8ed24e52c264f073ecbf4e9254f861
3,Not required,Partial,CVE-2010-1155,https://www.cvedetails.com/cve/CVE-2010-1155/,CWE-20,Medium,Partial,Partial,2010-04-16,6.8,"Irssi before 0.8.15, when SSL is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IRC servers via an arbitrary certificate.",2017-08-16,,https://github.com/ensc/irssi-proxy/commit/85bbc05b21678e80423815d2ef1dfe26208491ab,85bbc05b21678e80423815d2ef1dfe26208491ab,"Check if an SSL certificate matches the hostname of the server we are connecting to

git-svn-id: http://svn.irssi.org/repos/irssi/trunk@5104 dbcabf3a-b0e7-0310-adc4-f8d773084564","{""sha"": ""5a9c9bc71553d37a17b89654bec0b6e98b5679b9"", ""filename"": ""src/core/network-openssl.c"", ""status"": ""modified"", ""additions"": 152, ""deletions"": 5, ""changes"": 157, ""blob_url"": ""https://github.com/ensc/irssi-proxy/blob/85bbc05b21678e80423815d2ef1dfe26208491ab/src/core/network-openssl.c"", ""raw_url"": ""https://github.com/ensc/irssi-proxy/raw/85bbc05b21678e80423815d2ef1dfe26208491ab/src/core/network-openssl.c"", ""contents_url"": ""https://api.github.com/repos/ensc/irssi-proxy/contents/src/core/network-openssl.c?ref=85bbc05b21678e80423815d2ef1dfe26208491ab"", ""patch"": ""@@ -26,6 +26,7 @@\n \n #include <openssl/crypto.h>\n #include <openssl/x509.h>\n+#include <openssl/x509v3.h>\n #include <openssl/pem.h>\n #include <openssl/ssl.h>\n #include <openssl/err.h>\n@@ -39,6 +40,7 @@ typedef struct\n \tSSL *ssl;\n \tSSL_CTX *ctx;\n \tunsigned int verify:1;\n+\tconst char *hostname;\n } GIOSSLChannel;\n \n static SSL_CTX *ssl_ctx = NULL;\n@@ -53,7 +55,149 @@ static void irssi_ssl_free(GIOChannel *handle)\n \tg_free(chan);\n }\n \n-static gboolean irssi_ssl_verify(SSL *ssl, SSL_CTX *ctx, X509 *cert)\n+/* Checks if the given string has internal NUL characters. */\n+static gboolean has_internal_nul(const char* str, int len) {\n+\t/* Remove trailing nul characters. They would give false alarms */\n+\twhile (len > 0 && str[len-1] == 0)\n+\t\tlen--;\n+\treturn strlen(str) != len;\n+}\n+\n+/* tls_dns_name - Extract valid DNS name from subjectAltName value */\n+static const char *tls_dns_name(const GENERAL_NAME * gn)\n+{\n+\tconst char *dnsname;\n+\n+\t/* We expect the OpenSSL library to construct GEN_DNS extension objects as\n+\t   ASN1_IA5STRING values. Check we got the right union member. */\n+\tif (ASN1_STRING_type(gn->d.ia5) != V_ASN1_IA5STRING) {\n+\t\tg_warning(\""Invalid ASN1 value type in subjectAltName\"");\n+\t\treturn NULL;\n+\t}\n+\n+\t/* Safe to treat as an ASCII string possibly holding a DNS name */\n+\tdnsname = (char *) ASN1_STRING_data(gn->d.ia5);\n+\n+\tif (has_internal_nul(dnsname, ASN1_STRING_length(gn->d.ia5))) {\n+\t\tg_warning(\""Internal NUL in subjectAltName\"");\n+\t\treturn NULL;\n+\t}\n+\n+\treturn dnsname;\n+}\n+\n+/* tls_text_name - extract certificate property value by name */\n+static char *tls_text_name(X509_NAME *name, int nid)\n+{\n+\tint     pos;\n+\tX509_NAME_ENTRY *entry;\n+\tASN1_STRING *entry_str;\n+\tint     utf8_length;\n+\tunsigned char *utf8_value;\n+\tchar *result;\n+\n+\tif (name == 0 || (pos = X509_NAME_get_index_by_NID(name, nid, -1)) < 0) {\n+\t\treturn NULL;\n+    }\n+\n+    entry = X509_NAME_get_entry(name, pos);\n+    g_return_val_if_fail(entry != NULL, NULL);\n+    entry_str = X509_NAME_ENTRY_get_data(entry);\n+    g_return_val_if_fail(entry_str != NULL, NULL);\n+\n+    /* Convert everything into UTF-8. It's up to OpenSSL to do something\n+\t   reasonable when converting ASCII formats that contain non-ASCII\n+\t   content. */\n+    if ((utf8_length = ASN1_STRING_to_UTF8(&utf8_value, entry_str)) < 0) {\n+    \tg_warning(\""Error decoding ASN.1 type=%d\"", ASN1_STRING_type(entry_str));\n+    \treturn NULL;\n+    }\n+\n+    if (has_internal_nul((char *)utf8_value, utf8_length)) {\n+    \tg_warning(\""NUL character in hostname in certificate\"");\n+    \tOPENSSL_free(utf8_value);\n+    \treturn NULL;\n+    }\n+\n+    result = g_strdup((char *) utf8_value);\n+\tOPENSSL_free(utf8_value);\n+\treturn result;\n+}\n+\n+\n+/** check if a hostname in the certificate matches the hostname we used for the connection */\n+static gboolean match_hostname(const char *cert_hostname, const char *hostname)\n+{\n+\tconst char *hostname_left;\n+\n+\tif (!strcasecmp(cert_hostname, hostname)) { /* exact match */\n+\t\treturn TRUE;\n+\t} else if (cert_hostname[0] == '*' && cert_hostname[1] == '.' && cert_hostname[2] != 0) { /* wildcard match */\n+\t\t/* The initial '*' matches exactly one hostname component */\n+\t\thostname_left = strchr(hostname, '.');\n+\t\tif (hostname_left != NULL && ! strcasecmp(hostname_left + 1, cert_hostname + 2)) {\n+\t\t\treturn TRUE;\n+\t\t}\n+\t}\n+\treturn FALSE;\n+}\n+\n+/* based on verify_extract_name from tls_client.c in postfix */\n+static gboolean irssi_ssl_verify_hostname(X509 *cert, const char *hostname)\n+{\n+\tint gen_index, gen_count;\n+\tgboolean matched = FALSE, has_dns_name = FALSE;\n+\tconst char *cert_dns_name;\n+\tchar *cert_subject_cn;\n+\tconst GENERAL_NAME *gn;\n+\tSTACK_OF(GENERAL_NAME) * gens;\n+\n+\t/* Verify the dNSName(s) in the peer certificate against the hostname. */\n+\tgens = X509_get_ext_d2i(cert, NID_subject_alt_name, 0, 0);\n+\tif (gens) {\n+\t\tgen_count = sk_GENERAL_NAME_num(gens);\n+\t\tfor (gen_index = 0; gen_index < gen_count && !matched; ++gen_index) {\n+\t\t\tgn = sk_GENERAL_NAME_value(gens, gen_index);\n+\t\t\tif (gn->type != GEN_DNS)\n+\t\t\t\tcontinue;\n+\n+\t\t\t/* Even if we have an invalid DNS name, we still ultimately\n+\t\t\t   ignore the CommonName, because subjectAltName:DNS is\n+\t\t\t   present (though malformed). */\n+\t\t\thas_dns_name = TRUE;\n+\t\t\tcert_dns_name = tls_dns_name(gn);\n+\t\t\tif (cert_dns_name && *cert_dns_name) {\n+\t\t\t\tmatched = match_hostname(cert_dns_name, hostname);\n+\t\t\t}\n+    \t}\n+\n+\t    /* Free stack *and* member GENERAL_NAME objects */\n+\t    sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);\n+\t}\n+\n+\tif (has_dns_name) {\n+\t\tif (! matched) {\n+\t\t\t/* The CommonName in the issuer DN is obsolete when SubjectAltName is available. */\n+\t\t\tg_warning(\""None of the Subject Alt Names in the certificate match hostname '%s'\"", hostname);\n+\t\t}\n+\t\treturn matched;\n+\t} else { /* No subjectAltNames, look at CommonName */\n+\t\tcert_subject_cn = tls_text_name(X509_get_subject_name(cert), NID_commonName);\n+\t    if (cert_subject_cn && *cert_subject_cn) {\n+\t    \tmatched = match_hostname(cert_subject_cn, hostname);\n+\t    \tif (! matched) {\n+\t\t\t\tg_warning(\""SSL certificate common name '%s' doesn't match host name '%s'\"", cert_subject_cn, hostname);\n+\t    \t}\n+\t    } else {\n+\t    \tg_warning(\""No subjectAltNames and no valid common name in certificate\"");\n+\t    }\n+\t    free(cert_subject_cn);\n+\t}\n+\n+\treturn matched;\n+}\n+\n+static gboolean irssi_ssl_verify(SSL *ssl, SSL_CTX *ctx, const char* hostname, X509 *cert)\n {\n \tif (SSL_get_verify_result(ssl) != X509_V_OK) {\n \t\tunsigned char md[EVP_MAX_MD_SIZE];\n@@ -89,6 +233,8 @@ static gboolean irssi_ssl_verify(SSL *ssl, SSL_CTX *ctx, X509 *cert)\n \t\t\t}\n \t\t}\n \t\treturn FALSE;\n+\t} else if (! irssi_ssl_verify_hostname(cert, hostname)){\n+\t\treturn FALSE;\n \t}\n \treturn TRUE;\n }\n@@ -241,7 +387,7 @@ static gboolean irssi_ssl_init(void)\n \n }\n \n-static GIOChannel *irssi_ssl_get_iochannel(GIOChannel *handle, const char *mycert, const char *mypkey, const char *cafile, const char *capath, gboolean verify)\n+static GIOChannel *irssi_ssl_get_iochannel(GIOChannel *handle, const char *hostname, const char *mycert, const char *mypkey, const char *cafile, const char *capath, gboolean verify)\n {\n \tGIOSSLChannel *chan;\n \tGIOChannel *gchan;\n@@ -326,6 +472,7 @@ static GIOChannel *irssi_ssl_get_iochannel(GIOChannel *handle, const char *mycer\n \tchan->ssl = ssl;\n \tchan->ctx = ctx;\n \tchan->verify = verify;\n+\tchan->hostname = hostname;\n \n \tgchan = (GIOChannel *)chan;\n \tgchan->funcs = &irssi_ssl_channel_funcs;\n@@ -336,14 +483,14 @@ static GIOChannel *irssi_ssl_get_iochannel(GIOChannel *handle, const char *mycer\n \treturn gchan;\n }\n \n-GIOChannel *net_connect_ip_ssl(IPADDR *ip, int port, IPADDR *my_ip, const char *cert, const char *pkey, const char *cafile, const char *capath, gboolean verify)\n+GIOChannel *net_connect_ip_ssl(IPADDR *ip, int port, const char* hostname, IPADDR *my_ip, const char *cert, const char *pkey, const char *cafile, const char *capath, gboolean verify)\n {\n \tGIOChannel *handle, *ssl_handle;\n \n \thandle = net_connect_ip(ip, port, my_ip);\n \tif (handle == NULL)\n \t\treturn NULL;\n-\tssl_handle  = irssi_ssl_get_iochannel(handle, cert, pkey, cafile, capath, verify);\n+\tssl_handle  = irssi_ssl_get_iochannel(handle, hostname, cert, pkey, cafile, capath, verify);\n \tif (ssl_handle == NULL)\n \t\tg_io_channel_unref(handle);\n \treturn ssl_handle;\n@@ -385,7 +532,7 @@ int irssi_ssl_handshake(GIOChannel *handle)\n \t\tg_warning(\""SSL server supplied no certificate\"");\n \t\treturn -1;\n \t}\n-\tret = !chan->verify || irssi_ssl_verify(chan->ssl, chan->ctx, cert);\n+\tret = !chan->verify || irssi_ssl_verify(chan->ssl, chan->ctx, chan->hostname, cert);\n \tX509_free(cert);\n \treturn ret ? 0 : -1;\n }""}<_**next**_>{""sha"": ""8583724c99c1210ab22de05fecf10df355c6a4bf"", ""filename"": ""src/core/network.h"", ""status"": ""modified"", ""additions"": 1, ""deletions"": 1, ""changes"": 2, ""blob_url"": ""https://github.com/ensc/irssi-proxy/blob/85bbc05b21678e80423815d2ef1dfe26208491ab/src/core/network.h"", ""raw_url"": ""https://github.com/ensc/irssi-proxy/raw/85bbc05b21678e80423815d2ef1dfe26208491ab/src/core/network.h"", ""contents_url"": ""https://api.github.com/repos/ensc/irssi-proxy/contents/src/core/network.h?ref=85bbc05b21678e80423815d2ef1dfe26208491ab"", ""patch"": ""@@ -47,7 +47,7 @@ int net_ip_compare(IPADDR *ip1, IPADDR *ip2);\n /* Connect to socket */\n GIOChannel *net_connect(const char *addr, int port, IPADDR *my_ip);\n /* Connect to socket with ip address and SSL*/\n-GIOChannel *net_connect_ip_ssl(IPADDR *ip, int port, IPADDR *my_ip, const char *cert, const char *pkey, const char *cafile, const char *capath, gboolean verify);\n+GIOChannel *net_connect_ip_ssl(IPADDR *ip, int port, const char* hostname, IPADDR *my_ip, const char *cert, const char *pkey, const char *cafile, const char *capath, gboolean verify);\n int irssi_ssl_handshake(GIOChannel *handle);\n /* Connect to socket with ip address */\n GIOChannel *net_connect_ip(IPADDR *ip, int port, IPADDR *my_ip);""}<_**next**_>{""sha"": ""017a2036779e15856a64d1d3489f0f653201c689"", ""filename"": ""src/core/servers.c"", ""status"": ""modified"", ""additions"": 1, ""deletions"": 1, ""changes"": 2, ""blob_url"": ""https://github.com/ensc/irssi-proxy/blob/85bbc05b21678e80423815d2ef1dfe26208491ab/src/core/servers.c"", ""raw_url"": ""https://github.com/ensc/irssi-proxy/raw/85bbc05b21678e80423815d2ef1dfe26208491ab/src/core/servers.c"", ""contents_url"": ""https://api.github.com/repos/ensc/irssi-proxy/contents/src/core/servers.c?ref=85bbc05b21678e80423815d2ef1dfe26208491ab"", ""patch"": ""@@ -224,7 +224,7 @@ static void server_real_connect(SERVER_REC *server, IPADDR *ip,\n \t\tport = server->connrec->proxy != NULL ?\n \t\t\tserver->connrec->proxy_port : server->connrec->port;\n \t\thandle = server->connrec->use_ssl ?\n-\t\t\tnet_connect_ip_ssl(ip, port, own_ip, server->connrec->ssl_cert, server->connrec->ssl_pkey,\n+\t\t\tnet_connect_ip_ssl(ip, port, server->connrec->address, own_ip, server->connrec->ssl_cert, server->connrec->ssl_pkey,\n server->connrec->ssl_cafile, server->connrec->ssl_capath, server->connrec->ssl_verify) :\n \t\t\tnet_connect_ip(ip, port, own_ip);\n \t} else {""}",C,irssi-proxy,85bbc05b21678e80423815d2ef1dfe26208491ab,d5688da48306918cdfd79ee9b27abe377204befb
4,Not required,Partial,CVE-2010-1152,https://www.cvedetails.com/cve/CVE-2010-1152/,CWE-20,Low,,,2010-04-12,5.0,memcached.c in memcached before 1.4.3 allows remote attackers to cause a denial of service (daemon hang or crash) via a long line that triggers excessive memory allocation.  NOTE: some of these details are obtained from third party information.,2011-03-01,DoS ,https://github.com/memcached/memcached/commit/d9cd01ede97f4145af9781d448c62a3318952719,d9cd01ede97f4145af9781d448c62a3318952719,Use strncmp when checking for large ascii multigets.,"{""sha"": ""3e2e9c59e274910dd88af6fbb73006279b5a6016"", ""filename"": ""memcached.c"", ""status"": ""modified"", ""additions"": 3, ""deletions"": 1, ""changes"": 4, ""blob_url"": ""https://github.com/memcached/memcached/blob/d9cd01ede97f4145af9781d448c62a3318952719/memcached.c"", ""raw_url"": ""https://github.com/memcached/memcached/raw/d9cd01ede97f4145af9781d448c62a3318952719/memcached.c"", ""contents_url"": ""https://api.github.com/repos/memcached/memcached/contents/memcached.c?ref=d9cd01ede97f4145af9781d448c62a3318952719"", ""patch"": ""@@ -3148,7 +3148,9 @@ static int try_read_command(conn *c) {\n                     ++ptr;\n                 }\n \n-                if (strcmp(ptr, \""get \"") && strcmp(ptr, \""gets \"")) {\n+                if (ptr - c->rcurr > 100 ||\n+                    (strncmp(ptr, \""get \"", 4) && strncmp(ptr, \""gets \"", 5))) {\n+\n                     conn_set_state(c, conn_closing);\n                     return 1;\n                 }""}",C,memcached,d9cd01ede97f4145af9781d448c62a3318952719,ea0fec7989ba00cf68326d017fd801a1716f8855
5,Not required,Partial,CVE-2010-0011,https://www.cvedetails.com/cve/CVE-2010-0011/,CWE-264,Low,Partial,Partial,2010-02-25,7.5,"The eval_js function in uzbl-core.c in Uzbl before 2010.01.05 exposes the run method of the Uzbl object, which allows remote attackers to execute arbitrary commands via JavaScript code.",2017-08-16,Exec Code ,https://github.com/Dieterbe/uzbl/commit/1958b52d41cba96956dc1995660de49525ed1047,1958b52d41cba96956dc1995660de49525ed1047,disable Uzbl javascript object because of security problem.,"{""sha"": ""a22e105934e4dbd5360e68f28cdbb7474022d4e5"", ""filename"": ""README"", ""status"": ""modified"", ""additions"": 1, ""deletions"": 20, ""changes"": 21, ""blob_url"": ""https://github.com/uzbl/uzbl/blob/1958b52d41cba96956dc1995660de49525ed1047/README"", ""raw_url"": ""https://github.com/uzbl/uzbl/raw/1958b52d41cba96956dc1995660de49525ed1047/README"", ""contents_url"": ""https://api.github.com/repos/uzbl/uzbl/contents/README?ref=1958b52d41cba96956dc1995660de49525ed1047"", ""patch"": ""@@ -397,7 +397,7 @@ The script specific arguments are this:\n \n Custom, userdefined scripts (`spawn foo bar`) get first the arguments as specified in the config and then the above 7 are added at the end.\n \n-### JAVASCRIPT HELPER OBJECT\n+### JAVASCRIPT HELPER OBJECT DISABLED BECAUSE OF SECURITY LEAK\n \n Javascript code run from uzbl is given a special object in the global namespace which gives special privileges to these scripts. This object is called `Uzbl`, and it is added and removed before and after the script execution so that it is hidden to web javascripts (There is no race condition, since all the javascript code runs in a single thread)\n \n@@ -410,25 +410,6 @@ Currently, the `Uzbl` object provides only one function:\n        * `Uzbl.run(\""spawn insert_bookmark.sh\"")`\n        * `uri = Uzbl.run(\""print @uri\"")` (see variable expansion below)\n \n-### JAVASCRIPT SECURITY\n-\n-Since defined variables and functions are set in the global namespace (`window` object) as default, it is recommended to wrap your scripts like this:\n-\n-    (function(Uzbl) {\n-        ...\n-    })(Uzbl);\n-\n-This way, everything is kept private. It also turns Uzbl into a local variable, which can be accessed from callback functions defined inside. However for some situations, isolating everything isn't an option, for example, with binds. You can define them directly in the script body, and use `var Uzbl = window.Uzbl;` to make the Uzbl variable local, as in the following example:\n-\n-    function f() {\n-        var Uzbl = window.Uzbl;\n-        Uzbl.run(...);\n-        setTimeout(function() {\n-            Uzbl.run(...);\n-        }, 500);\n-    }\n-\n-Copying the Uzbl object and creating public functions should be taken with care to avoid creating security holes. Keep in mind that the \""f\"" function above would be defined in the `window` object, and as such any javascript in the current page can call it.\n \n ### EVENTS ###\n ""}<_**next**_>{""sha"": ""fc3b092ea0dd6a2593c92178eb07049a95160a60"", ""filename"": ""tests/test-command.c"", ""status"": ""modified"", ""additions"": 0, ""deletions"": 5, ""changes"": 5, ""blob_url"": ""https://github.com/uzbl/uzbl/blob/1958b52d41cba96956dc1995660de49525ed1047/tests/test-command.c"", ""raw_url"": ""https://github.com/uzbl/uzbl/raw/1958b52d41cba96956dc1995660de49525ed1047/tests/test-command.c"", ""contents_url"": ""https://api.github.com/repos/uzbl/uzbl/contents/tests/test-command.c?ref=1958b52d41cba96956dc1995660de49525ed1047"", ""patch"": ""@@ -305,11 +305,6 @@ test_js (void) {\n     parse_cmd_line(\""js ('x' + 345).toUpperCase()\"", result);\n     g_assert_cmpstr(\""X345\"", ==, result->str);\n \n-    /* uzbl commands can be run from javascript */\n-    uzbl.net.useragent = \""Test useragent\"";\n-    parse_cmd_line(\""js Uzbl.run('print @useragent').toUpperCase();\"", result);\n-    g_assert_cmpstr(\""TEST USERAGENT\"", ==, result->str);\n-\n     g_string_free(result, TRUE);\n }\n ""}<_**next**_>{""sha"": ""fca293c1f5e8ff116ae4de3e1d3f2ecc51f593f6"", ""filename"": ""uzbl-core.c"", ""status"": ""modified"", ""additions"": 0, ""deletions"": 10, ""changes"": 10, ""blob_url"": ""https://github.com/uzbl/uzbl/blob/1958b52d41cba96956dc1995660de49525ed1047/uzbl-core.c"", ""raw_url"": ""https://github.com/uzbl/uzbl/raw/1958b52d41cba96956dc1995660de49525ed1047/uzbl-core.c"", ""contents_url"": ""https://api.github.com/repos/uzbl/uzbl/contents/uzbl-core.c?ref=1958b52d41cba96956dc1995660de49525ed1047"", ""patch"": ""@@ -1046,7 +1046,6 @@ eval_js(WebKitWebView * web_view, gchar *script, GString *result) {\n     WebKitWebFrame *frame;\n     JSGlobalContextRef context;\n     JSObjectRef globalobject;\n-    JSStringRef var_name;\n \n     JSStringRef js_script;\n     JSValueRef js_result;\n@@ -1059,12 +1058,6 @@ eval_js(WebKitWebView * web_view, gchar *script, GString *result) {\n     context = webkit_web_frame_get_global_context(frame);\n     globalobject = JSContextGetGlobalObject(context);\n \n-    /* uzbl javascript namespace */\n-    var_name = JSStringCreateWithUTF8CString(\""Uzbl\"");\n-    JSObjectSetProperty(context, globalobject, var_name,\n-                        JSObjectMake(context, uzbl.js.classref, NULL),\n-                        kJSClassAttributeNone, NULL);\n-\n     /* evaluate the script and get return value*/\n     js_script = JSStringCreateWithUTF8CString(script);\n     js_result = JSEvaluateScript(context, js_script, globalobject, NULL, 0, NULL);\n@@ -1082,9 +1075,6 @@ eval_js(WebKitWebView * web_view, gchar *script, GString *result) {\n     }\n \n     /* cleanup */\n-    JSObjectDeleteProperty(context, globalobject, var_name, NULL);\n-\n-    JSStringRelease(var_name);\n     JSStringRelease(js_script);\n }\n ""}",C,uzbl,1958b52d41cba96956dc1995660de49525ed1047,49941155e43eb520c43b02b55e0bbced2b657cf6
6,Not required,Partial,CVE-2011-2161,https://www.cvedetails.com/cve/CVE-2011-2161/,CWE-399,Medium,,,2011-05-20,4.3,"The ape_read_header function in ape.c in libavformat in FFmpeg before 0.5.4, as used in MPlayer, VideoLAN VLC media player, and other products, allows remote attackers to cause a denial of service (application crash) via an APE (aka Monkey's Audio) file that contains a header but no frames.",2018-10-17,DoS ,https://github.com/FFmpeg/FFmpeg/commit/8312e3fc9041027a33c8bc667bb99740fdf41dd5,8312e3fc9041027a33c8bc667bb99740fdf41dd5,"Do not attempt to decode APE file with no frames

This fixes invalid reads/writes with this sample:
http://packetstorm.linuxsecurity.com/1103-exploits/vlc105-dos.txt","{""sha"": ""dd2aeb9ff3068d949282a5359ab56685ffa43c65"", ""filename"": ""libavformat/ape.c"", ""status"": ""modified"", ""additions"": 4, ""deletions"": 0, ""changes"": 4, ""blob_url"": ""https://github.com/FFmpeg/FFmpeg/blob/8312e3fc9041027a33c8bc667bb99740fdf41dd5/libavformat/ape.c"", ""raw_url"": ""https://github.com/FFmpeg/FFmpeg/raw/8312e3fc9041027a33c8bc667bb99740fdf41dd5/libavformat/ape.c"", ""contents_url"": ""https://api.github.com/repos/FFmpeg/FFmpeg/contents/libavformat/ape.c?ref=8312e3fc9041027a33c8bc667bb99740fdf41dd5"", ""patch"": ""@@ -242,6 +242,10 @@ static int ape_read_header(AVFormatContext * s, AVFormatParameters * ap)\n             avio_seek(pb, ape->wavheaderlength, SEEK_CUR);\n     }\n \n+    if(!ape->totalframes){\n+        av_log(s, AV_LOG_ERROR, \""No frames in the file!\\n\"");\n+        return AVERROR(EINVAL);\n+    }\n     if(ape->totalframes > UINT_MAX / sizeof(APEFrame)){\n         av_log(s, AV_LOG_ERROR, \""Too many frames: %d\\n\"", ape->totalframes);\n         return -1;""}",C,FFmpeg,8312e3fc9041027a33c8bc667bb99740fdf41dd5,1dac4d554734b16757b36a0adc71642c5ef2c4e6
7,Not required,,CVE-2011-1575,https://www.cvedetails.com/cve/CVE-2011-1575/,CWE-399,Medium,Partial,Partial,2011-05-23,5.8,"The STARTTLS implementation in ftp_parser.c in Pure-FTPd before 1.0.30 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted FTP sessions by sending a cleartext command that is processed after TLS is in place, related to a *plaintext command injection* attack, a similar issue to CVE-2011-0411.",2014-02-20,,https://github.com/jedisct1/pure-ftpd/commit/65c4d4ad331e94661de763e9b5304d28698999c4,65c4d4ad331e94661de763e9b5304d28698999c4,"Flush the command buffer after switching to TLS.
Fixes a flaw similar to CVE-2011-0411.","{""sha"": ""69a42a3441266f3e83d83a8597bb80e48c968be5"", ""filename"": ""src/ftp_parser.c"", ""status"": ""modified"", ""additions"": 9, ""deletions"": 2, ""changes"": 11, ""blob_url"": ""https://github.com/jedisct1/pure-ftpd/blob/65c4d4ad331e94661de763e9b5304d28698999c4/src/ftp_parser.c"", ""raw_url"": ""https://github.com/jedisct1/pure-ftpd/raw/65c4d4ad331e94661de763e9b5304d28698999c4/src/ftp_parser.c"", ""contents_url"": ""https://api.github.com/repos/jedisct1/pure-ftpd/contents/src/ftp_parser.c?ref=65c4d4ad331e94661de763e9b5304d28698999c4"", ""patch"": ""@@ -57,14 +57,20 @@ static void randomdelay(void)\n  * -Frank.\n  */\n \n+static size_t scanned;\n+static size_t readnbd;\n+\n+static void flush_cmd(void)\n+{\n+    scanned = readnbd = (size_t) 0U;\n+}\n+\n int sfgets(void)\n {\n     struct pollfd pfd;\n     int pollret;\n     ssize_t readnb;\n     signed char seen_r = 0;\n-    static size_t scanned;\n-    static size_t readnbd;\n     \n     if (scanned > (size_t) 0U) {       /* support pipelining */\n         readnbd -= scanned;        \n@@ -362,6 +368,7 @@ void parser(void)\n             addreply_noformat(234, \""AUTH TLS OK.\"");\n             doreply();\n             if (tls_cnx == NULL) {\n+                flush_cmd();\n                 (void) tls_init_new_session();\n             }\n             goto wayout;""}",C,pure-ftpd,65c4d4ad331e94661de763e9b5304d28698999c4,67b0385e0871ad3fc48b2244abb30eb673161146
8,Not required,Partial,CVE-2011-0530,https://www.cvedetails.com/cve/CVE-2011-0530/,CWE-119,Low,Partial,Partial,2011-02-22,7.5,Buffer overflow in the mainloop function in nbd-server.c in the server in Network Block Device (nbd) before 2.9.20 might allow remote attackers to execute arbitrary code via a long request.  NOTE: this issue exists because of a CVE-2005-3534 regression.,2017-08-16,Exec Code Overflow ,https://github.com/yoe/nbd/commit/3ef52043861ab16352d49af89e048ba6339d6df8,3ef52043861ab16352d49af89e048ba6339d6df8,"Fix buffer size checking

Yes, this means we've re-introduced CVE-2005-3534. Sigh.","{""sha"": ""b47da867a828a6220fda1dfdb6126801618a056f"", ""filename"": ""nbd-server.c"", ""status"": ""modified"", ""additions"": 2, ""deletions"": 2, ""changes"": 4, ""blob_url"": ""https://github.com/NetworkBlockDevice/nbd/blob/3ef52043861ab16352d49af89e048ba6339d6df8/nbd-server.c"", ""raw_url"": ""https://github.com/NetworkBlockDevice/nbd/raw/3ef52043861ab16352d49af89e048ba6339d6df8/nbd-server.c"", ""contents_url"": ""https://api.github.com/repos/NetworkBlockDevice/nbd/contents/nbd-server.c?ref=3ef52043861ab16352d49af89e048ba6339d6df8"", ""patch"": ""@@ -150,7 +150,7 @@ gboolean do_oldstyle=FALSE;\n #define OFFT_MAX ~((off_t)1<<(sizeof(off_t)*8-1))\n #define LINELEN 256\t  /**< Size of static buffer used to read the\n \t\t\t       authorization file (yuck) */\n-#define BUFSIZE (1024*1024) /**< Size of buffer that can hold requests */\n+#define BUFSIZE ((1024*1024)+sizeof(struct nbd_reply)) /**< Size of buffer that can hold requests */\n #define DIFFPAGESIZE 4096 /**< diff file uses those chunks */\n #define F_READONLY 1      /**< flag to tell us a file is readonly */\n #define F_MULTIFILE 2\t  /**< flag to tell us a file is exported using -m */\n@@ -1389,7 +1389,7 @@ int mainloop(CLIENT *client) {\n \n \t\tif (request.magic != htonl(NBD_REQUEST_MAGIC))\n \t\t\terr(\""Not enough magic.\"");\n-\t\tif (len > BUFSIZE + sizeof(struct nbd_reply))\n+\t\tif (len > BUFSIZE - sizeof(struct nbd_reply))\n \t\t\terr(\""Request too big!\"");\n #ifdef DODBG\n \t\tprintf(\""%s from %llu (%llu) len %d, \"", request.type ? \""WRITE\"" :""}",C,nbd,3ef52043861ab16352d49af89e048ba6339d6df8,50e7e7e9378c1528b045860682070c5de2c6c721
9,Not required,Complete,CVE-2012-5532,https://www.cvedetails.com/cve/CVE-2012-5532/,,Low,,,2012-12-27,4.9,"The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.8-rc1, allows local users to cause a denial of service (daemon exit) via a crafted application that sends a Netlink message.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-2669.",2017-08-28,DoS ,https://github.com/torvalds/linux/commit/95a69adab9acfc3981c504737a2b6578e4d846ef,95a69adab9acfc3981c504737a2b6578e4d846ef,"tools: hv: Netlink source address validation allows DoS

The source code without this patch caused hypervkvpd to exit when it processed
a spoofed Netlink packet which has been sent from an untrusted local user.
Now Netlink messages with a non-zero nl_pid source address are ignored
and a warning is printed into the syslog.

Signed-off-by: Tomas Hozza <thozza@redhat.com>
Acked-by:  K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","{""sha"": ""c1d910243d49abe6012595d50227648873994ed8"", ""filename"": ""tools/hv/hv_kvp_daemon.c"", ""status"": ""modified"", ""additions"": 7, ""deletions"": 1, ""changes"": 8, ""blob_url"": ""https://github.com/torvalds/linux/blob/95a69adab9acfc3981c504737a2b6578e4d846ef/tools/hv/hv_kvp_daemon.c"", ""raw_url"": ""https://github.com/torvalds/linux/raw/95a69adab9acfc3981c504737a2b6578e4d846ef/tools/hv/hv_kvp_daemon.c"", ""contents_url"": ""https://api.github.com/repos/torvalds/linux/contents/tools/hv/hv_kvp_daemon.c?ref=95a69adab9acfc3981c504737a2b6578e4d846ef"", ""patch"": ""@@ -1486,13 +1486,19 @@ int main(void)\n \t\tlen = recvfrom(fd, kvp_recv_buffer, sizeof(kvp_recv_buffer), 0,\n \t\t\t\taddr_p, &addr_l);\n \n-\t\tif (len < 0 || addr.nl_pid) {\n+\t\tif (len < 0) {\n \t\t\tsyslog(LOG_ERR, \""recvfrom failed; pid:%u error:%d %s\"",\n \t\t\t\t\taddr.nl_pid, errno, strerror(errno));\n \t\t\tclose(fd);\n \t\t\treturn -1;\n \t\t}\n \n+\t\tif (addr.nl_pid) {\n+\t\t\tsyslog(LOG_WARNING, \""Received packet from untrusted pid:%u\"",\n+\t\t\t\t\taddr.nl_pid);\n+\t\t\tcontinue;\n+\t\t}\n+\n \t\tincoming_msg = (struct nlmsghdr *)kvp_recv_buffer;\n \t\tincoming_cn_msg = (struct cn_msg *)NLMSG_DATA(incoming_msg);\n \t\thv_msg = (struct hv_kvp_msg *)incoming_cn_msg->data;""}",C,linux,95a69adab9acfc3981c504737a2b6578e4d846ef,aeba4a06f28fad11b1e61d150bd3cde3008b80c8