Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2020-12790: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 7.5
Published: 2020-05-11T19:15Z
Repository: https://github.com/nystudio107/craft-seomatic
Language: Unknown
Commit date: 2020-03-24 17:56:34 -0400
Commit message: Merge branch 'release/3.2.49' into v3
CVE-2020-9757: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2020-03-04T17:15Z
Repository: https://github.com/nystudio107/craft-seomatic
Language: Markdown
Files changed: CHANGELOG.md
Commit date: 2020-04-27 19:25:12 -0400
Commit message: Version 3.3.0

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 73b349af..90ad04df 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,10 +16,13 @@
 ### Fixed
 * If a page has a `robots` tag that marks it as `noindex` or `none`, don't include a canonical URL
 * No longer delete caches  in response to `TemplateCaches::EVENT_AFTER_DELETE_CACHES`
 * Fixed an issue where SEO previews could have the wrong URLs for multi-site setups
 
+### Security
+* Fixed a regression where malformed data passed to the metacontainers controller could result in SSTI which leads to information disclosure
+
 ## 3.2.51 - 2020.04.06
 ### Added
 * Updated to [Schema.org 7.0.3](https://schema.org/version/7.03/schema-all.html) including [SpecialAnnouncement](https://webmasters.googleblog.com/2020/04/highlight-covid-19-announcements-search.html) and other types/changes to handle the COVID-19 crisis
 * Added several optional properties to the [Event](https://developers.google.com/search/docs/data-types/event) schema.org type: `eventStatus`, `eventAttendanceMode`, and `previousStartDate`
 * Included the `extension` schema.org types as well as `core` schema.org types

Fixed code: ### Security
* Fixed a regression where malformed data passed to the metacontainers controller could result in SSTI which leads to information disclosure
CVE-2020-9757: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 9.8
Published: 2020-03-04T17:15Z
Repository: https://github.com/nystudio107/craft-seomatic
Language: Markdown
Files changed: CHANGELOG.md
Commit date: 2020-03-03 22:02:13 +1100
Commit message: Version 3.2.46

Signed-off-by: Andrew Welch <andrew@nystudio107.com>

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index b01a0760..fd3638b6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,11 +3,11 @@
 ## 3.2.46 - 2020.03.02
 ### Changed
 * Fixed some dates to dateCreated as categories doesn't have postDate
 
 ### Security
-* Fixed an issue where malformed data passed to the metacontainers controller could result in XSS
+* Fixed an issue where malformed data passed to the metacontainers controller could result in SSTI which leads to information disclosure
 
 ## 3.2.45 - 2020.02.28
 ### Added
 * Added the ability to query by site handle via GraphQL (in addition to `siteId`)
 

Vulnerable code: * Fixed an issue where malformed data passed to the metacontainers controller could result in XSS
Fixed code: * Fixed an issue where malformed data passed to the metacontainers controller could result in SSTI which leads to information disclosure
CVE-2021-41749: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2022-06-12T11:15Z
Repository: https://github.com/nystudio107/craft-seomatic
Language: PHP
Files changed: src/services/Helper.php
Commit date: 2021-09-24 14:08:04 -0400
Commit message: Sanitize the canonical URL after the absolute URL has been returned, to mitigate poisoned `X-Forwarded-Host` headers

Diff: diff --git a/src/services/Helper.php b/src/services/Helper.php
index 8cac2428f..c1aded868 100644
--- a/src/services/Helper.php
+++ b/src/services/Helper.php
@@ -146,13 +146,12 @@ class Helper extends Component
         try {
             $url = Craft::$app->getRequest()->getPathInfo();
         } catch (InvalidConfigException $e) {
             Craft::error($e->getMessage(), __METHOD__);
         }
-        $url = DynamicMetaHelper::sanitizeUrl($url);
 
-        return UrlHelper::absoluteUrlWithProtocol($url);
+        return DynamicMetaHelper::sanitizeUrl(UrlHelper::absoluteUrlWithProtocol($url));
     }
 
     /**
      * Return the site URL for a given URL. This gives SEOmatic a chance to override it
      *

Vulnerable code:         $url = DynamicMetaHelper::sanitizeUrl($url);
        return UrlHelper::absoluteUrlWithProtocol($url);
Fixed code:         return DynamicMetaHelper::sanitizeUrl(UrlHelper::absoluteUrlWithProtocol($url));
CVE-2021-41750: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName parameter containing an arbitrary filename with the intended content-type to be rendered in the user's browser as the extension.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-06-12T12:15Z
Repository: https://github.com/nystudio107/craft-seomatic
Language: PHP
Files changed: src/controllers/FileController.php
Commit date: 2021-09-24 11:01:54 -0400
Commit message: Disallow SVGs

Diff: diff --git a/src/controllers/FileController.php b/src/controllers/FileController.php
index 33d7f0582..43315dfa6 100644
--- a/src/controllers/FileController.php
+++ b/src/controllers/FileController.php
@@ -94,11 +94,11 @@ class FileController extends Controller
             // ref: https://craftcms.com/docs/3.x/config/config-settings.html#allowedfileextensions
             $allowedExtensions = Craft::$app->getConfig()->getGeneral()->allowedFileExtensions;
             if (($ext = pathinfo($fileName, PATHINFO_EXTENSION)) !== '') {
                 $ext = strtolower($ext);
             }
-            if ($ext === '' || !in_array($ext, $allowedExtensions, true)) {
+            if ($ext === '' || $ext === 'svg' || !in_array($ext, $allowedExtensions, true)) {
                 throw new ServerErrorHttpException(Craft::t('seomatic', 'File format not allowed.'));
             }
             // Send the file as a stream, so it can exist anywhere
             $response->sendContentAsFile(
                 $contents,

Vulnerable code:             if ($ext === '' || !in_array($ext, $allowedExtensions, true)) {
Fixed code:             if ($ext === '' || $ext === 'svg' || !in_array($ext, $allowedExtensions, true)) {
CVE-2021-44618: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 9.8
Published: 2022-03-11T16:15Z
Repository: https://github.com/nystudio107/craft-seomatic
Language: PHP
Files changed: src/helpers/UrlHelper.php
Commit date: 2021-09-25 00:44:33 -0400
Commit message: Sanitize all URLs

Signed-off-by: Andrew Welch <andrew@nystudio107.com>

Diff: diff --git a/src/helpers/UrlHelper.php b/src/helpers/UrlHelper.php
index 250a921ee..4f0f1c353 100644
--- a/src/helpers/UrlHelper.php
+++ b/src/helpers/UrlHelper.php
@@ -54,11 +54,11 @@ class UrlHelper extends CraftUrlHelper
             }
 
             return $url;
         }
 
-        return parent::siteUrl($path, $params, $scheme, $siteId);
+        return DynamicMeta::sanitizeUrl(parent::siteUrl($path, $params, $scheme, $siteId));
     }
 
     /**
      * Return the page trigger and the value of the page trigger (null if it doesn't exist)
      *
@@ -128,11 +128,11 @@ class UrlHelper extends CraftUrlHelper
         }
         if (!$generalConfig->addTrailingSlashesToUrls) {
             $url = rtrim($url, '/');
         }
 
-        return $url;
+        return DynamicMeta::sanitizeUrl($url);
     }
 
     /**
      * Return whether this URL has a sub-directory as part of it
      *

Vulnerable code:         return parent::siteUrl($path, $params, $scheme, $siteId);
        return $url;
Fixed code:         return DynamicMeta::sanitizeUrl(parent::siteUrl($path, $params, $scheme, $siteId));
        return DynamicMeta::sanitizeUrl($url);
CVE-2019-11404: Missing Encryption of Sensitive Data (CWE-311)
value: arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by an MITM attack.
CWE description: The product does not encrypt sensitive or critical information before storage or transmission.
CVSS v3 base score: 5.9
Published: 2019-04-22T11:29Z
Repository: https://github.com/arrow-kt/arrow
Language: Other
Files changed: build.gradle
Commit date: 2019-02-19 09:11:32 -0800
Commit message: Fix some http vulnerabilities
Diff: diff --git a/build.gradle b/build.gradle
index 5da8d01f..08e84d1c 100644
--- a/build.gradle
+++ b/build.gradle
@@ -37,11 +37,11 @@ buildscript {
     repositories {
         maven {
             url "https://plugins.gradle.org/m2/"
         }
         jcenter()
-        maven { url "http://dl.bintray.com/kotlin/kotlin-dev" }
+        maven { url "https://dl.bintray.com/kotlin/kotlin-dev" }
         maven { url "https://dl.bintray.com/jetbrains/markdown/" }
         maven { url "https://dl.bintray.com/arrow-kt/arrow-kt/" }
     }
 
     dependencies {
@@ -67,12 +67,12 @@ allprojects {
     }
 
     repositories {
         jcenter()
         maven { url 'https://kotlin.bintray.com/kotlinx' }
-        maven { url "http://dl.bintray.com/kotlin/kotlin-dev" }
-        maven { url "http://dl.bintray.com/arrow-kt/arrow-kt" }
+        maven { url "https://dl.bintray.com/kotlin/kotlin-dev" }
+        maven { url "https://dl.bintray.com/arrow-kt/arrow-kt" }
         maven { url "https://dl.bintray.com/jetbrains/markdown/" }
     }
 }
 
 subprojects { project ->
@@ -250,6 +250,6 @@ dependencyUpdates {
     }
 }
 
 task checkDependenciesVersion {
     dependsOn dependencyUpdates
-}
\ No newline at end of file
+}

Vulnerable code:         maven { url "http://dl.bintray.com/kotlin/kotlin-dev" }
        maven { url "http://dl.bintray.com/kotlin/kotlin-dev" }
        maven { url "http://dl.bintray.com/arrow-kt/arrow-kt" }
}
Fixed code:         maven { url "https://dl.bintray.com/kotlin/kotlin-dev" }
        maven { url "https://dl.bintray.com/kotlin/kotlin-dev" }
        maven { url "https://dl.bintray.com/arrow-kt/arrow-kt" }
}
CVE-2015-10071: Weak Password Recovery Mechanism for Forgotten Password (CWE-640)
value: A vulnerability was found in gitter-badger ezpublish-modern-legacy. It has been rated as problematic. This issue affects some unknown processing of the file kernel/user/forgotpassword.php. The manipulation leads to weak password recovery. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 1.0 is able to address this issue. The patch is named 5908d5ee65fec61ce0e321d586530461a210bf2a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218951.
CWE description: The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
CVSS v3 base score: 7.5
Published: 2023-01-19T10:15Z
Repository: https://github.com/gitter-badger/ezpublish-modern-legacy
Language: PHP
Files changed: kernel/user/forgotpassword.php
Commit date: 2015-05-11 11:14:12 +0200
Commit message: Fix EZP-24140: Potential vulnerability in eZ Publish password recovery

Use openssl_random_pseudo_bytes() if available, otherwise fall back to mt_rand(). Use microtime() for entropy.

Diff: diff --git a/kernel/user/forgotpassword.php b/kernel/user/forgotpassword.php
index 488b78c875..22e6c17c1c 100644
--- a/kernel/user/forgotpassword.php
+++ b/kernel/user/forgotpassword.php
@@ -111,11 +111,15 @@ if ( $module->isCurrentAction( "Generate" ) )
         if ( isset($users) && count($users) > 0 )
         {
             $user   = $users[0];
             $time   = time();
             $userID = $user->id();
-            $hashKey = md5( $userID . ':' . $time . ':' . mt_rand() );
+            $hashKey = md5(
+                $userID . ':' . microtime() . ':' .
+                ( function_exists( "openssl_random_pseudo_bytes" ) ?
+                    openssl_random_pseudo_bytes( 32 ) : mt_rand() )
+            );
 
             // Create forgot password object
             if ( eZOperationHandler::operationIsAvailable( 'user_forgotpassword' ) )
             {
                 $operationResult = eZOperationHandler::execute( 'user',

Vulnerable code:             $hashKey = md5( $userID . ':' . $time . ':' . mt_rand() );
Fixed code:             $hashKey = md5(
                $userID . ':' . microtime() . ':' .
                ( function_exists( "openssl_random_pseudo_bytes" ) ?
                    openssl_random_pseudo_bytes( 32 ) : mt_rand() )
            );
CVE-2017-5581: Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
value: Buffer overflow in the ModifiablePixelBuffer::fillRect function in TigerVNC before 1.7.1 allows remote servers to execute arbitrary code via an RRE message with subrectangle outside framebuffer boundaries.
CWE description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CVSS v3 base score: 9.8
Published: 2017-02-28T18:59Z
Repository: https://github.com/TigerVNC/tigervnc
Language: Other
Files changed: common/rfb/PixelBuffer.cxx
Commit date: 2017-01-17 16:47:50 +0200
Commit message: Fix buffer overflow in ModifiablePixelBuffer::fillRect.

It can be triggered by RRE message with subrectangle out of framebuffer
boundaries. It may prevent the same kind of issue caused by evil message
from another encoding too.

Diff: diff --git a/common/rfb/PixelBuffer.cxx b/common/rfb/PixelBuffer.cxx
index 89addabc..7f3df6cb 100644
--- a/common/rfb/PixelBuffer.cxx
+++ b/common/rfb/PixelBuffer.cxx
@@ -99,19 +99,30 @@ ModifiablePixelBuffer::~ModifiablePixelBuffer()
 void ModifiablePixelBuffer::fillRect(const Rect& r, const void* pix)
 {
   int stride;
   U8 *buf;
   int w, h, b;
+  Rect drect;
 
-  w = r.width();
-  h = r.height();
+  drect = r;
+  if (!drect.enclosed_by(getRect())) {
+    vlog.error("Destination rect %dx%d at %d,%d exceeds framebuffer %dx%d",
+               drect.width(), drect.height(), drect.tl.x, drect.tl.y, width_, height_);
+    drect = drect.intersect(getRect());
+  }
+
+  if (drect.is_empty())
+    return;
+
+  w = drect.width();
+  h = drect.height();
   b = format.bpp/8;
 
   if (h == 0)
     return;
 
-  buf = getBufferRW(r, &stride);
+  buf = getBufferRW(drect, &stride);
 
   if (b == 1) {
     while (h--) {
       memset(buf, *(const U8*)pix, w);
       buf += stride * b;
@@ -134,11 +145,11 @@ void ModifiablePixelBuffer::fillRect(const Rect& r, const void* pix)
       memcpy(buf, start, w * b);
       buf += stride * b;
     }
   }
 
-  commitBufferRW(r);
+  commitBufferRW(drect);
 }
 
 void ModifiablePixelBuffer::imageRect(const Rect& r,
                                       const void* pixels, int srcStride)
 {

Vulnerable code:   w = r.width();
  h = r.height();
  buf = getBufferRW(r, &stride);
  commitBufferRW(r);
Fixed code:   Rect drect;
  drect = r;
  if (!drect.enclosed_by(getRect())) {
    vlog.error("Destination rect %dx%d at %d,%d exceeds framebuffer %dx%d",
               drect.width(), drect.height(), drect.tl.x, drect.tl.y, width_, height_);
    drect = drect.intersect(getRect());
  }

  if (drect.is_empty())
    return;

  w = drect.width();
  h = drect.height();
  buf = getBufferRW(drect, &stride);
  commitBufferRW(drect);
CVE-2020-7741: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1).
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 9.9
Published: 2020-10-06T15:15Z
Repository: https://github.com/MrSwitch/hello.js
Language: JavaScript
Files changed: src/hello.js
Commit date: 2020-10-06 12:20:56 +0100
Commit message: fix(xss): oauth_redirect should be a valid url

Diff: diff --git a/src/hello.js b/src/hello.js
index e2c57a7..e8618d1 100644
--- a/src/hello.js
+++ b/src/hello.js
@@ -1386,12 +1386,16 @@ hello.utils.extend(hello.utils, {
 
 		// OAuth redirect, fixes URI fragments from being lost in Safari
 		// (URI Fragments within 302 Location URI are lost over HTTPS)
 		// Loading the redirect.html before triggering the OAuth Flow seems to fix it.
 		else if ('oauth_redirect' in p) {
+			var url = decodeURIComponent(p.oauth_redirect);
+
+			if (isValidUrl(url)) {
+				location.assign(url);
+			}
 
-			location.assign(decodeURIComponent(p.oauth_redirect));
 			return;
 		}
 
 		function isValidUrl(url) {
 			var regexp = /^https?:/;

Vulnerable code: 			location.assign(decodeURIComponent(p.oauth_redirect));
Fixed code: 			var url = decodeURIComponent(p.oauth_redirect);

			if (isValidUrl(url)) {
				location.assign(url);
			}
CVE-2022-4878: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: A vulnerability classified as critical has been found in JATOS. Affected is the function ZipUtil of the file modules/common/app/utils/common/ZipUtil.java of the component ZIP Handler. The manipulation leads to path traversal. Upgrading to version 3.7.5-alpha is able to address this issue. The name of the patch is 2b42519f309d8164e8811392770ce604cdabb5da. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217548.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 5.3
Published: 2023-01-06T10:15Z
Repository: https://github.com/JATOS/JATOS
Language: Java
Files changed: modules/common/app/utils/common/ZipUtil.java
Commit date: 2022-04-23 16:24:52 +0200
Commit message: ZipUtil.java - check for path traversal attack

Diff: diff --git a/modules/common/app/utils/common/ZipUtil.java b/modules/common/app/utils/common/ZipUtil.java
index 284c794f..332a0641 100644
--- a/modules/common/app/utils/common/ZipUtil.java
+++ b/modules/common/app/utils/common/ZipUtil.java
@@ -32,10 +32,11 @@ public class ZipUtil {
     /**
      * Unzips the given File. Creates a new directory in the system's temp directory and writes the
      * zip's content in there. The method can handle recursive unzipping of sub-directories.
      */
     public static File unzip(File fileToUnzip, File destDir) throws IOException {
+        destDir = destDir.toPath().normalize().toFile(); // normalize to prevent path traversal attacks
         FileUtils.deleteQuietly(destDir);
         IOUtils.createDir(destDir);
         destDir.deleteOnExit();
 
         File file;

Fixed code:         destDir = destDir.toPath().normalize().toFile(); // normalize to prevent path traversal attacks
CVE-2019-11923: Allocation of Resources Without Limits or Throttling (CWE-770)
value: In Mcrouter prior to v0.41.0, the deprecated ASCII parser would allocate a buffer to a user-specified length with no maximum length enforced, allowing for resource exhaustion or denial of service.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 7.5
Published: 2019-12-04T16:15Z
Repository: https://github.com/facebook/mcrouter
Language: C
Files changed: mcrouter/lib/network/McAsciiParser.h, mcrouter/lib/network/McAsciiParser.rl
Commit date: 2019-07-30 11:36:37 -0700
Commit message: Enforce a limit on value bytes size

Summary:
Enforce a limit on value bytes size

This is a fix for CVE-2019-11923

Reviewed By: stuclar

Differential Revision: D16471999

fbshipit-source-id: 9d614da8534e20935b1561c613bb81defd7d470a

Diff: diff --git a/mcrouter/lib/network/McAsciiParser.h b/mcrouter/lib/network/McAsciiParser.h
index f24a7aa9..9d2f010d 100644
--- a/mcrouter/lib/network/McAsciiParser.h
+++ b/mcrouter/lib/network/McAsciiParser.h
@@ -79,10 +79,13 @@ class McAsciiParserBase {
   static void trimIOBufToRange(
       folly::IOBuf& buffer,
       const char* posStart,
       const char* posEnd);
 
+  // limit the value size.
+  static constexpr uint32_t maxValueBytes = 1 * 1024 * 1024 * 1024; // 1GB
+
   std::string currentErrorDescription_;
 
   uint64_t currentUInt_{0};
 
   folly::IOBuf* currentIOBuf_{nullptr};
diff --git a/mcrouter/lib/network/McAsciiParser.rl b/mcrouter/lib/network/McAsciiParser.rl
index 36e02085..3ff07814 100644
--- a/mcrouter/lib/network/McAsciiParser.rl
+++ b/mcrouter/lib/network/McAsciiParser.rl
@@ -135,10 +135,14 @@ exptime_req = negative? uint %{
   negative_ = false;
 };
 
 value_bytes = uint %{
   remainingIOBufLength_ = static_cast<size_t>(currentUInt_);
+  // Enforce maximum on value size obtained from parser                       
+  if (remainingIOBufLength_ > maxValueBytes) {
+    remainingIOBufLength_ = maxValueBytes;                                    
+  }
 };
 
 cas_id = uint %{
   message.casToken() = currentUInt_;
 };

Fixed code:   // limit the value size.
  static constexpr uint32_t maxValueBytes = 1 * 1024 * 1024 * 1024; // 1GB

  // Enforce maximum on value size obtained from parser                       
  if (remainingIOBufLength_ > maxValueBytes) {
    remainingIOBufLength_ = maxValueBytes;                                    
  }
CVE-2016-4484: Improper Authentication (CWE-287)
value: The Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically proximate attackers to gain shell access via many log in attempts with an invalid password.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 6.8
Published: 2017-01-23T21:59Z
Repository: https://gitlab.com/cryptsetup/cryptsetup
Language: Markdown
Files changed: README.md
Commit date: 2016-11-16 16:14:02 +0100
Commit message: Update Readme.md.

Diff: diff --git a/README.md b/README.md
index 810d281..763eff7 100644
--- a/README.md
+++ b/README.md
@@ -30,10 +30,16 @@ Why LUKS?
  * free.
 
 [Project home page](https://gitlab.com/cryptsetup/cryptsetup/).
 -----------------
 
+**CVE-2016-4484 (Initrd root shell)**
+
+This is problem in **intramfs** **scripts** only (these are **not** part of cryptsetup project), it is neiter bug in cryptsetup nor in LUKS.  
+Some distributions could add these scripts to distributed package, please check your distro updates for more info.
+
+
 [Frequently asked questions (FAQ)](https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions)
 --------------------------------
 
 Download
 --------

Fixed code: **CVE-2016-4484 (Initrd root shell)**

This is problem in **intramfs** **scripts** only (these are **not** part of cryptsetup project), it is neiter bug in cryptsetup nor in LUKS.  
Some distributions could add these scripts to distributed package, please check your distro updates for more info.
CVE-2024-22049: Exposure of Resource to Wrong Sphere (CWE-668)
value: httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.


CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 5.3
Published: 2024-01-04T21:15Z
Repository: https://github.com/jnunemaker/httparty
Language: Unknown
Commit date: 2022-12-30 15:59:07 -0500
Commit message: Merge pull request from GHSA-5pq7-52mg-hr42

escape filename in the multipart/form-data Content-Disposition header
CVE-2015-10099: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability classified as critical has been found in CP Appointment Calendar Plugin up to 1.1.5 on WordPress. This affects the function dex_process_ready_to_go_appointment of the file dex_appointments.php. The manipulation of the argument itemnumber leads to sql injection. It is possible to initiate the attack remotely. The patch is named e29a9cdbcb0f37d887dd302a05b9e8bf213da01d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-225351.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-04-10T12:15Z
Repository: https://github.com/wp-plugins/cp-appointment-calendar
Language: PHP
Files changed: dex_appointments.php
Commit date: 2015-02-12 20:00:56 +0000
Commit message: Validation to prevent SQL injection.

git-svn-id: https://plugins.svn.wordpress.org/cp-appointment-calendar/trunk@1088427 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/dex_appointments.php b/dex_appointments.php
index 01e1e65..ddfcf5c 100644
--- a/dex_appointments.php
+++ b/dex_appointments.php
@@ -338,10 +338,12 @@ function dex_appointments_check_IPN_verification() {
 
 function dex_process_ready_to_go_appointment($itemnumber, $payer_email = "")
 {
    global $wpdb;
    
+   $itemnumber = intval($itemnumber);
+   
    $myrows = $wpdb->get_results( "SELECT * FROM ".DEX_APPOINTMENTS_TABLE_NAME." WHERE id=".$itemnumber );   
        
    $SYSTEM_EMAIL = get_option('notification_from_email', DEX_APPOINTMENTS_DEFAULT_PAYPAL_EMAIL);
    $SYSTEM_RCPT_EMAIL = get_option('notification_destination_email', DEX_APPOINTMENTS_DEFAULT_PAYPAL_EMAIL);
    

Fixed code:    $itemnumber = intval($itemnumber);
CVE-2022-23605: Improper Removal of Sensitive Information Before Storage or Transfer (CWE-212)
value: Wire webapp is a web client for the wire messaging protocol. In versions prior to 2022-01-27-production.0 expired ephemeral messages were not reliably removed from local chat history of Wire Webapp. In versions before 2022-01-27-production.0 ephemeral messages and assets might still be accessible through the local search functionality. Any attempt to view one of these message in the chat view will then trigger the deletion. This issue only affects locally stored messages. On premise instances of wire-webapp need to be updated to 2022-01-27-production.0, so that their users are no longer affected. There are no known workarounds for this issue.
CWE description: The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
CVSS v3 base score: 2.3
Published: 2022-02-04T23:15Z
Repository: https://github.com/wireapp/wire-webapp
Language: Unknown
Commit date: 2022-01-27 19:18:37 +0100
Commit message: Merge pull request from GHSA-2w3m-ppfg-hg62

fix(core): Improve ephemeral message handling
CVE-2024-36400: Insufficient Entropy (CWE-331)
value: nano-id is a unique string ID generator for Rust. Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the `nano_id::base62` and `nano_id::base58` functions. Specifically, the `base62` function used a character set of 32 symbols instead of the intended 62 symbols, and the `base58` function used a character set of 16 symbols instead of the intended 58 symbols. Additionally, the `nano_id::gen` macro is also affected when a custom character set that is not a power of 2 in size is specified. It should be noted that `nano_id::base64` is not affected by this vulnerability. This can result in a significant reduction in entropy, making the generated IDs predictable and vulnerable to brute-force attacks when the IDs are used in security-sensitive contexts such as session tokens or unique identifiers. The vulnerability is fixed in 0.4.0.
CWE description: The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
CVSS v3 base score: 9.8
Published: 2024-06-04T15:15Z
Repository: https://github.com/viz-rs/nano-id
Language: Unknown
Commit date: 2024-06-03 06:28:23 +0800
Commit message: Merge pull request #10 from viz-rs/fix-security

bump: v0.4.0
CVE-2021-43725: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the data[performredirect] parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-03-28T13:15Z
Repository: https://github.com/spotweb/spotweb
Language: PHP
Files changed: lib/page/SpotPage_login.php
Commit date: 2021-11-13 10:29:17 +0100
Commit message: Update SpotPage_login.php

For for issue: https://github.com/spotweb/spotweb/issues/718
Diff: diff --git a/lib/page/SpotPage_login.php b/lib/page/SpotPage_login.php
index a413d4bf..acf639c9 100644
--- a/lib/page/SpotPage_login.php
+++ b/lib/page/SpotPage_login.php
@@ -35,11 +35,16 @@ class SpotPage_login extends SpotPage_Abs
         // set the page title
         $this->_pageTitle = 'spot: login';
 
         // bring the form action into the local scope
         $formAction = $this->_loginForm['action'];
-
+        
+        // Check redirect for chevrons, deny if found.
+        if (preg_match('/[<>]/i', $this->_params['data']['performredirect'])) {			
+		$result->addError(_('Script is not allowed'));
+		}
+        
         // Are we already submitting the form login?
         if (!empty($formAction)) {
             // make sure we can simply assume all fields are there
             $credentials = array_merge($credentials, $this->_loginForm);
 

Fixed code:         
        // Check redirect for chevrons, deny if found.
        if (preg_match('/[<>]/i', $this->_params['data']['performredirect'])) {			
		$result->addError(_('Script is not allowed'));
		}
CVE-2019-13568: Out-of-bounds Write (CWE-787)
value: CImg through 2.6.7 has a heap-based buffer overflow in _load_bmp in CImg.h because of erroneous memory allocation for a malformed BMP image.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 8.8
Published: 2019-07-31T15:15Z
Repository: https://github.com/dtschump/CImg
Language: C
Files changed: CImg.h
Commit date: 2019-07-11 22:12:33 +0200
Commit message: .

Diff: diff --git a/CImg.h b/CImg.h
index 6c8a8d8..25c39ad 100644
--- a/CImg.h
+++ b/CImg.h
@@ -49301,11 +49301,12 @@ namespace cimg_library_suffixed {
       const int xoffset = offset - 14 - header_size - 4*nb_colors;
       if (xoffset>0) cimg::fseek(nfile,xoffset,SEEK_CUR);
 
       CImg<ucharT> buffer;
       if (buf_size<cimg_iobuffer) {
-        buffer.assign(cimg::abs(dy)*(dx_bytes + align_bytes),1,1,1,0);
+//        buffer.assign(cimg::abs(dy)*(dx_bytes + align_bytes),1,1,1,0);
+        buffer.assign(buf_size,1,1,1,0);
         cimg::fread(buffer._data,buf_size,nfile);
       } else buffer.assign(dx_bytes + align_bytes);
       unsigned char *ptrs = buffer;
 
       // Decompress buffer (if necessary)

Vulnerable code:         buffer.assign(cimg::abs(dy)*(dx_bytes + align_bytes),1,1,1,0);
Fixed code: //        buffer.assign(cimg::abs(dy)*(dx_bytes + align_bytes),1,1,1,0);
        buffer.assign(buf_size,1,1,1,0);
CVE-2023-41049: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: @dcl/single-sign-on-client is an open source npm library which deals with single sign on authentication flows. Improper input validation in the `init` function allows arbitrary javascript to be executed using  the `javascript:` prefix. This vulnerability has been patched on version `0.1.0`. Users are advised to upgrade. Users unable to upgrade should limit untrusted user input to the `init` function.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-09-01T20:15Z
Repository: https://github.com/decentraland/single-sign-on-client
Language: Unknown
Commit date: 2023-08-31 15:48:55 -0300
Commit message: Merge pull request #2 from decentraland/feat/verify-url

feat: verify url
CVE-2015-5081: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before 3.1.1 allows remote attackers to manipulate privileged users into performing unknown actions via unspecified vectors.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2017-08-18T18:29Z
Repository: https://github.com/divio/django-cms
Language: Unknown
Commit date: 2015-06-27 21:58:41 +0200
Commit message: Merge pull request #4218 from divio/issues/merge_csrf_fix

Issues/merge csrf fix
CVE-2024-23770: Insufficient Information (NVD-CWE-noinfo)
value: darkhttpd through 1.15 allows local users to discover credentials (for --auth) by listing processes and their arguments.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.5
Published: 2024-01-22T04:15Z
Repository: https://github.com/emikulic/darkhttpd
Language: C
Files changed: darkhttpd.c
Commit date: 2024-01-18 10:23:33 +1100
Commit message: Document that --auth is not secure.

Suggested-by: SUSE Security Team <security@suse.de>

Diff: diff --git a/darkhttpd.c b/darkhttpd.c
index 7180fe1..23b12a7 100644
--- a/darkhttpd.c
+++ b/darkhttpd.c
@@ -939,11 +939,13 @@ static void usage(const char *argv0) {
     printf("\t--timeout secs (default: %d)\n"
     "\t\tIf a connection is idle for more than this many seconds,\n"
     "\t\tit will be closed. Set to zero to disable timeouts.\n\n",
     timeout_secs);
     printf("\t--auth username:password\n"
-    "\t\tEnable basic authentication.\n\n");
+    "\t\tEnable basic authentication. This is *INSECURE*: passwords\n"
+    "\t\tare sent unencrypted over HTTP, plus the password is visible\n"
+    "\t\tin ps(1) to other users on the system.\n\n");
     printf("\t--forward-https\n"
     "\t\tIf the client requested HTTP, forward to HTTPS.\n"
     "\t\tThis is useful if darkhttpd is behind a reverse proxy\n"
     "\t\tthat supports SSL.\n\n");
     printf("\t--header 'Header: Value'\n"

Vulnerable code:     "\t\tEnable basic authentication.\n\n");
Fixed code:     "\t\tEnable basic authentication. This is *INSECURE*: passwords\n"
    "\t\tare sent unencrypted over HTTP, plus the password is visible\n"
    "\t\tin ps(1) to other users on the system.\n\n");
CVE-2019-1010292: Out-of-bounds Write (CWE-787)
value: Linaro/OP-TEE OP-TEE Prior to version v3.4.0 is affected by: Boundary checks. The impact is: This could lead to corruption of any memory which the TA can access. The component is: optee_os. The fixed version is: v3.4.0.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2019-07-16T14:15Z
Repository: https://github.com/OP-TEE/optee_os
Language: C
Files changed: core/arch/arm/tee/entry_std.c
Commit date: 2019-01-21 18:28:37 +0100
Commit message: core: ensure that supplied range matches MOBJ

In set_rmem_param() if the MOBJ is found by the cookie it's verified to
represent non-secure shared memory. Prior to this patch the supplied
sub-range to be used of the MOBJ was not checked here and relied on
later checks further down the chain. Those checks seems to be enough
for user TAs, but not for pseudo TAs where the size isn't checked.

This patch adds a check for offset and size to see that they remain
inside the memory covered by the MOBJ.

Fixes: OP-TEE-2018-0004: "Unchecked parameters are passed through from
REE".

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reported-by: Riscure <inforequest@riscure.com>
Reported-by: Alyssa Milburn <a.a.milburn@vu.nl>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

Diff: diff --git a/core/arch/arm/tee/entry_std.c b/core/arch/arm/tee/entry_std.c
index 960833b6..29269819 100644
--- a/core/arch/arm/tee/entry_std.c
+++ b/core/arch/arm/tee/entry_std.c
@@ -99,19 +99,28 @@ static TEE_Result set_tmem_param(const struct optee_msg_param_tmem *tmem,
 }
 
 static TEE_Result set_rmem_param(const struct optee_msg_param_rmem *rmem,
 				 struct param_mem *mem)
 {
+	size_t req_size = 0;
 	uint64_t shm_ref = READ_ONCE(rmem->shm_ref);
 
 	mem->mobj = mobj_reg_shm_get_by_cookie(shm_ref);
 	if (!mem->mobj)
 		return TEE_ERROR_BAD_PARAMETERS;
 
 	mem->offs = READ_ONCE(rmem->offs);
 	mem->size = READ_ONCE(rmem->size);
 
+	/*
+	 * Check that the supplied offset and size is covered by the
+	 * previously verified MOBJ.
+	 */
+	if (ADD_OVERFLOW(mem->offs, mem->size, &req_size) ||
+	    mem->mobj->size < req_size)
+		return TEE_ERROR_SECURITY;
+
 	return TEE_SUCCESS;
 }
 
 static TEE_Result copy_in_params(const struct optee_msg_param *params,
 				 uint32_t num_params,

Fixed code: 	size_t req_size = 0;
	/*
	 * Check that the supplied offset and size is covered by the
	 * previously verified MOBJ.
	 */
	if (ADD_OVERFLOW(mem->offs, mem->size, &req_size) ||
	    mem->mobj->size < req_size)
		return TEE_ERROR_SECURITY;
CVE-2019-1010293: Out-of-bounds Write (CWE-787)
value: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Boundary crossing. The impact is: Memory corruption of the TEE itself. The component is: optee_os. The fixed version is: 3.4.0 and later.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2019-07-15T18:15Z
Repository: https://github.com/OP-TEE/optee_os
Language: C
Files changed: core/arch/arm/mm/tee_mmu.c
Commit date: 2019-01-21 18:28:37 +0100
Commit message: core: tee_mmu_check_access_rights() check all pages

Prior to this patch tee_mmu_check_access_rights() checks an address in
each page of a supplied range. If both the start and length of that
range is unaligned the last page in the range is sometimes not checked.
With this patch the first address of each page in the range is checked
to simplify the logic of checking each page and the range and also to
cover the last page under all circumstances.

Fixes: OP-TEE-2018-0005: "tee_mmu_check_access_rights does not check
final page of TA buffer"

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reported-by: Riscure <inforequest@riscure.com>
Reported-by: Alyssa Milburn <a.a.milburn@vu.nl>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

Diff: diff --git a/core/arch/arm/mm/tee_mmu.c b/core/arch/arm/mm/tee_mmu.c
index 8de6c8db..4bc2aba5 100644
--- a/core/arch/arm/mm/tee_mmu.c
+++ b/core/arch/arm/mm/tee_mmu.c
@@ -755,14 +755,15 @@ TEE_Result tee_mmu_user_pa2va_helper(const struct user_ta_ctx *utc,
 TEE_Result tee_mmu_check_access_rights(const struct user_ta_ctx *utc,
 				       uint32_t flags, uaddr_t uaddr,
 				       size_t len)
 {
 	uaddr_t a;
+	uaddr_t end_addr = 0;
 	size_t addr_incr = MIN(CORE_MMU_USER_CODE_SIZE,
 			       CORE_MMU_USER_PARAM_SIZE);
 
-	if (ADD_OVERFLOW(uaddr, len, &a))
+	if (ADD_OVERFLOW(uaddr, len, &end_addr))
 		return TEE_ERROR_ACCESS_DENIED;
 
 	if ((flags & TEE_MEMORY_ACCESS_NONSECURE) &&
 	    (flags & TEE_MEMORY_ACCESS_SECURE))
 		return TEE_ERROR_ACCESS_DENIED;
@@ -773,11 +774,11 @@ TEE_Result tee_mmu_check_access_rights(const struct user_ta_ctx *utc,
 	 */
 	if (!(flags & TEE_MEMORY_ACCESS_ANY_OWNER) &&
 	   !tee_mmu_is_vbuf_inside_ta_private(utc, (void *)uaddr, len))
 		return TEE_ERROR_ACCESS_DENIED;
 
-	for (a = uaddr; a < (uaddr + len); a += addr_incr) {
+	for (a = ROUNDDOWN(uaddr, addr_incr); a < end_addr; a += addr_incr) {
 		uint32_t attr;
 		TEE_Result res;
 
 		res = tee_mmu_user_va2pa_attr(utc, (void *)a, NULL, &attr);
 		if (res != TEE_SUCCESS)

Vulnerable code: 	if (ADD_OVERFLOW(uaddr, len, &a))
	for (a = uaddr; a < (uaddr + len); a += addr_incr) {
Fixed code: 	uaddr_t end_addr = 0;
	if (ADD_OVERFLOW(uaddr, len, &end_addr))
	for (a = ROUNDDOWN(uaddr, addr_incr); a < end_addr; a += addr_incr) {
CVE-2019-1010294: Numeric Errors (CWE-189)
value: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Rounding error. The impact is: Potentially leaking code and/or data from previous Trusted Application. The component is: optee_os. The fixed version is: 3.4.0 and later.
CWE description: Weaknesses in this category are related to improper calculation or conversion of numbers.
CVSS v3 base score: 7.5
Published: 2019-07-15T18:15Z
Repository: https://github.com/OP-TEE/optee_os
Language: C
Files changed: core/arch/arm/kernel/user_ta.c
Commit date: 2019-01-21 18:28:37 +0100
Commit message: core: clear the entire TA area

Previously we cleared (memset to zero) the size corresponding to code
and data segments, however the allocation for the TA is made on the
granularity of the memory pool, meaning that we did not clear all memory
and because of that we could potentially leak code and data of a
previous loaded TA.

Fixes: OP-TEE-2018-0006: "Potential disclosure of previously loaded TA
code and data"

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Suggested-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reported-by: Riscure <inforequest@riscure.com>
Reported-by: Alyssa Milburn <a.a.milburn@vu.nl>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

Diff: diff --git a/core/arch/arm/kernel/user_ta.c b/core/arch/arm/kernel/user_ta.c
index 808cffd4..e70061e3 100644
--- a/core/arch/arm/kernel/user_ta.c
+++ b/core/arch/arm/kernel/user_ta.c
@@ -195,12 +195,16 @@ static struct mobj *alloc_ta_mem(size_t size)
 #ifdef CFG_PAGED_USER_TA
 	return mobj_paged_alloc(size);
 #else
 	struct mobj *mobj = mobj_mm_alloc(mobj_sec_ddr, size, &tee_mm_sec_ddr);
 
-	if (mobj)
-		memset(mobj_get_va(mobj, 0), 0, size);
+	if (mobj) {
+		size_t granularity = BIT(tee_mm_sec_ddr.shift);
+
+		/* Round up to allocation granularity size */
+		memset(mobj_get_va(mobj, 0), 0, ROUNDUP(size, granularity));
+	}
 	return mobj;
 #endif
 }
 
 static void init_utee_param(struct utee_params *up,

Vulnerable code: 	if (mobj)
		memset(mobj_get_va(mobj, 0), 0, size);
Fixed code: 	if (mobj) {
		size_t granularity = BIT(tee_mm_sec_ddr.shift);

		/* Round up to allocation granularity size */
		memset(mobj_get_va(mobj, 0), 0, ROUNDUP(size, granularity));
	}