rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: In FFmpeg 4.0.1, due to a missing check for negative values of the mquant variable, the vc1_put_blocks_clamped function in libavcodec/vc1_block.c may trigger an out-of-array access while converting a crafted AVI file to MPEG4, leading to an information disclosure or a denial of service.
Vulnerability ID: CVE-2018-13305
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/FFmpeg/FFmpeg
Published: 2018-07-05
File: libavcodec/vc1_block.c
Commit message: avcodec/vc1_block: Fix mqaunt check for negative values

Fixes: out of array access
Fixes: ffmpeg_bof_4.avi
Fixes: ffmpeg_bof_5.avi
Fixes: ffmpeg_bof_6.avi

Found-by: Thuan Pham, Marcel Böhme, Andrew Santosa and Alexandru Razvan Caciulescu with AFLSmart
Reviewed-by: Jerome Borsboom <jerome.borsboom@carpalis.nl>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static void vc1_put_blocks_clamped(VC1Context *v, int put_signed)         if ((edges&8) &&                                       \             s->mb_y == ((s->mb_height >> v->field_mode) - 1))  \             mquant = -v->altpq;                                \         if (!mquant || mquant > 31) {                          \             av_log(v->s.avctx, AV_LOG_ERROR,                   \                    "Overriding invalid mquant %d\n", mquant);  \             mquant = 1;                                        \

Fixed version (after fix):
 static void vc1_put_blocks_clamped(VC1Context *v, int put_signed)         if ((edges&8) &&                                       \             s->mb_y == ((s->mb_height >> v->field_mode) - 1))  \             mquant = -v->altpq;                                \         if (!mquant || mquant > 31 || mquant < -31) {                          \             av_log(v->s.avctx, AV_LOG_ERROR,                   \                    "Overriding invalid mquant %d\n", mquant);  \             mquant = 1;                                        \

Patch:
patch: @@ -207,7 +207,7 @@ static void vc1_put_blocks_clamped(VC1Context *v, int put_signed)
         if ((edges&8) &&                                       \
             s->mb_y == ((s->mb_height >> v->field_mode) - 1))  \
             mquant = -v->altpq;                                \
-        if (!mquant || mquant > 31) {                          \
+        if (!mquant || mquant > 31 || mquant < -31) {                          \
             av_log(v->s.avctx, AV_LOG_ERROR,                   \
                    "Overriding invalid mquant %d\n", mquant);  \
             mquant = 1;                                        \
path: libavcodec/vc1_block.c
Vulnerability: An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c in the Linux kernel before 4.17.4 could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used.
Vulnerability ID: CVE-2018-13406
CWE: CWE-190
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2018-07-06
File: drivers/video/fbdev/uvesafb.c
Commit message: video: uvesafb: Fix integer overflow in allocation

cmap->len can get close to INT_MAX/2, allowing for an integer overflow in
allocation. This uses kmalloc_array() instead to catch the condition.

Reported-by: Dr Silvio Cesare of InfoSect <silvio.cesare@gmail.com>
Fixes: 8bdb3a2d7df48 ("uvesafb: the driver core")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Commit author: Kees Cook

Vulnerable version (before fix):
 static int uvesafb_setcmap(struct fb_cmap *cmap, struct fb_info *info) 		    info->cmap.len || cmap->start < info->cmap.start) 			return -EINVAL;  		entries = kmalloc(sizeof(*entries) * cmap->len, GFP_KERNEL); 		if (!entries) 			return -ENOMEM; 

Fixed version (after fix):
 static int uvesafb_setcmap(struct fb_cmap *cmap, struct fb_info *info) 		    info->cmap.len || cmap->start < info->cmap.start) 			return -EINVAL;  		entries = kmalloc_array(cmap->len, sizeof(*entries), 					GFP_KERNEL); 		if (!entries) 			return -ENOMEM; 

Patch:
patch: @@ -1044,7 +1044,8 @@ static int uvesafb_setcmap(struct fb_cmap *cmap, struct fb_info *info)
 		    info->cmap.len || cmap->start < info->cmap.start)
 			return -EINVAL;
 
-		entries = kmalloc(sizeof(*entries) * cmap->len, GFP_KERNEL);
+		entries = kmalloc_array(cmap->len, sizeof(*entries),
+					GFP_KERNEL);
 		if (!entries)
 			return -ENOMEM;
path: drivers/video/fbdev/uvesafb.c
Vulnerability: In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service.
Vulnerability ID: CVE-2018-13785
CWE: CWE-369
Severity score: 2.9
Project: https://github.com/glennrp/libpng
Published: 2018-07-09
File: pngrutil.c
Commit message: [libpng16] Fix the calculation of row_factor in png_check_chunk_length

(Bug report by Thuan Pham, SourceForge issue #278)
Commit author: Cosmin Truta

Vulnerable version (before fix):
 png_check_chunk_length(png_const_structrp png_ptr, const png_uint_32 length)    {       png_alloc_size_t idat_limit = PNG_UINT_31_MAX;       size_t row_factor =          (png_ptr->width * png_ptr->channels * (png_ptr->bit_depth > 8? 2: 1)           + 1 + (png_ptr->interlaced? 6: 0));       if (png_ptr->height > PNG_UINT_32_MAX/row_factor)          idat_limit=PNG_UINT_31_MAX;       else          idat_limit = png_ptr->height * row_factor;       row_factor = row_factor > 32566? 32566 : row_factor;

Fixed version (after fix):
 png_check_chunk_length(png_const_structrp png_ptr, const png_uint_32 length)    {       png_alloc_size_t idat_limit = PNG_UINT_31_MAX;       size_t row_factor =          (size_t)png_ptr->width          * (size_t)png_ptr->channels          * (png_ptr->bit_depth > 8? 2: 1)          + 1          + (png_ptr->interlaced? 6: 0);       if (png_ptr->height > PNG_UINT_32_MAX/row_factor)          idat_limit = PNG_UINT_31_MAX;       else          idat_limit = png_ptr->height * row_factor;       row_factor = row_factor > 32566? 32566 : row_factor;

Patch:
patch: @@ -3167,10 +3167,13 @@ png_check_chunk_length(png_const_structrp png_ptr, const png_uint_32 length)
    {
       png_alloc_size_t idat_limit = PNG_UINT_31_MAX;
       size_t row_factor =
-         (png_ptr->width * png_ptr->channels * (png_ptr->bit_depth > 8? 2: 1)
-          + 1 + (png_ptr->interlaced? 6: 0));
+         (size_t)png_ptr->width
+         * (size_t)png_ptr->channels
+         * (png_ptr->bit_depth > 8? 2: 1)
+         + 1
+         + (png_ptr->interlaced? 6: 0);
       if (png_ptr->height > PNG_UINT_32_MAX/row_factor)
-         idat_limit=PNG_UINT_31_MAX;
+         idat_limit = PNG_UINT_31_MAX;
       else
          idat_limit = png_ptr->height * row_factor;
       row_factor = row_factor > 32566? 32566 : row_factor;
path: pngrutil.c
Vulnerability: In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service.
Vulnerability ID: CVE-2018-13785
CWE: CWE-190
Severity score: 2.9
Project: https://github.com/glennrp/libpng
Published: 2018-07-09
File: pngrutil.c
Commit message: [libpng16] Fix the calculation of row_factor in png_check_chunk_length

(Bug report by Thuan Pham, SourceForge issue #278)
Commit author: Cosmin Truta

Vulnerable version (before fix):
 png_check_chunk_length(png_const_structrp png_ptr, const png_uint_32 length)    {       png_alloc_size_t idat_limit = PNG_UINT_31_MAX;       size_t row_factor =          (png_ptr->width * png_ptr->channels * (png_ptr->bit_depth > 8? 2: 1)           + 1 + (png_ptr->interlaced? 6: 0));       if (png_ptr->height > PNG_UINT_32_MAX/row_factor)          idat_limit=PNG_UINT_31_MAX;       else          idat_limit = png_ptr->height * row_factor;       row_factor = row_factor > 32566? 32566 : row_factor;

Fixed version (after fix):
 png_check_chunk_length(png_const_structrp png_ptr, const png_uint_32 length)    {       png_alloc_size_t idat_limit = PNG_UINT_31_MAX;       size_t row_factor =          (size_t)png_ptr->width          * (size_t)png_ptr->channels          * (png_ptr->bit_depth > 8? 2: 1)          + 1          + (png_ptr->interlaced? 6: 0);       if (png_ptr->height > PNG_UINT_32_MAX/row_factor)          idat_limit = PNG_UINT_31_MAX;       else          idat_limit = png_ptr->height * row_factor;       row_factor = row_factor > 32566? 32566 : row_factor;

Patch:
patch: @@ -3167,10 +3167,13 @@ png_check_chunk_length(png_const_structrp png_ptr, const png_uint_32 length)
    {
       png_alloc_size_t idat_limit = PNG_UINT_31_MAX;
       size_t row_factor =
-         (png_ptr->width * png_ptr->channels * (png_ptr->bit_depth > 8? 2: 1)
-          + 1 + (png_ptr->interlaced? 6: 0));
+         (size_t)png_ptr->width
+         * (size_t)png_ptr->channels
+         * (png_ptr->bit_depth > 8? 2: 1)
+         + 1
+         + (png_ptr->interlaced? 6: 0);
       if (png_ptr->height > PNG_UINT_32_MAX/row_factor)
-         idat_limit=PNG_UINT_31_MAX;
+         idat_limit = PNG_UINT_31_MAX;
       else
          idat_limit = png_ptr->height * row_factor;
       row_factor = row_factor > 32566? 32566 : row_factor;
path: pngrutil.c
Vulnerability: The sdb_set_internal function in sdb.c in radare2 2.7.0 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted ELF file because of missing input validation in r_bin_dwarf_parse_comp_unit in libr/bin/dwarf.c.
Vulnerability ID: CVE-2018-14015
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/radareorg/radare2
Published: 2018-07-12
File: libr/bin/dwarf.c
Commit message: Fix #10465 - Avoid string on low addresses (workaround) for corrupted dwarf (#10478)
Commit author: radare

Vulnerable version (before fix):
 static const ut8 *r_bin_dwarf_parse_comp_unit(Sdb *s, const ut8 *obuf, 					&cu->hdr, debug_str, debug_str_len); 			if (cu->dies[cu->length].attr_values[i].name == DW_AT_comp_dir) { 				const char *name = cu->dies[cu->length].attr_values[i].encoding.str_struct.string; 				sdb_set (s, "DW_AT_comp_dir", name, 0); 			} 			cu->dies[cu->length].length++; 		}

Fixed version (after fix):
 static const ut8 *r_bin_dwarf_parse_comp_unit(Sdb *s, const ut8 *obuf, 					&cu->hdr, debug_str, debug_str_len); 			if (cu->dies[cu->length].attr_values[i].name == DW_AT_comp_dir) { 				const char *name = cu->dies[cu->length].attr_values[i].encoding.str_struct.string; 				if (name > 1024) { // solve some null derefs 					sdb_set (s, "DW_AT_comp_dir", name, 0); 				} else { 					eprintf ("Invalid string pointer at %p\n", name); 				} 			} 			cu->dies[cu->length].length++; 		}

Patch:
patch: @@ -1361,7 +1361,11 @@ static const ut8 *r_bin_dwarf_parse_comp_unit(Sdb *s, const ut8 *obuf,
 					&cu->hdr, debug_str, debug_str_len);
 			if (cu->dies[cu->length].attr_values[i].name == DW_AT_comp_dir) {
 				const char *name = cu->dies[cu->length].attr_values[i].encoding.str_struct.string;
-				sdb_set (s, "DW_AT_comp_dir", name, 0);
+				if (name > 1024) { // solve some null derefs
+					sdb_set (s, "DW_AT_comp_dir", name, 0);
+				} else {
+					eprintf ("Invalid string pointer at %p\n", name);
+				}
 			}
 			cu->dies[cu->length].length++;
 		}
path: libr/bin/dwarf.c
Vulnerability: ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in a web skin name to access files outside of the intended skins directories.
Vulnerability ID: CVE-2018-14056
CWE: CWE-22
Severity score: 2.9
Project: https://github.com/znc/znc
Published: 2018-07-15
File: src/WebModules.cpp
Commit message: Don't let web skin name ../../../../ access files outside of usual skins directories.

Thanks for Jeriko One <jeriko.one@gmx.us> for finding and reporting this.
Commit author: Alexey Sokolov

Vulnerable version (before fix):
 CWebSock::EPageReqResult CWebSock::PrintTemplate(const CString& sPageName, }  CString CWebSock::GetSkinPath(const CString& sSkinName) {     CString sRet = CZNC::Get().GetZNCPath() + "/webskins/" + sSkinName;      if (!CFile::IsDir(sRet)) {         sRet = CZNC::Get().GetCurPath() + "/webskins/" + sSkinName;          if (!CFile::IsDir(sRet)) {             sRet = CString(_SKINDIR_) + "/" + sSkinName;         }     } 

Fixed version (after fix):
 CWebSock::EPageReqResult CWebSock::PrintTemplate(const CString& sPageName, }  CString CWebSock::GetSkinPath(const CString& sSkinName) {     const CString sSkin = sSkinName.Replace_n("/", "_").Replace_n(".", "_");      CString sRet = CZNC::Get().GetZNCPath() + "/webskins/" + sSkin;      if (!CFile::IsDir(sRet)) {         sRet = CZNC::Get().GetCurPath() + "/webskins/" + sSkin;          if (!CFile::IsDir(sRet)) {             sRet = CString(_SKINDIR_) + "/" + sSkin;         }     } 

Patch:
patch: @@ -557,13 +557,15 @@ CWebSock::EPageReqResult CWebSock::PrintTemplate(const CString& sPageName,
 }
 
 CString CWebSock::GetSkinPath(const CString& sSkinName) {
-    CString sRet = CZNC::Get().GetZNCPath() + "/webskins/" + sSkinName;
+    const CString sSkin = sSkinName.Replace_n("/", "_").Replace_n(".", "_");
+
+    CString sRet = CZNC::Get().GetZNCPath() + "/webskins/" + sSkin;
 
     if (!CFile::IsDir(sRet)) {
-        sRet = CZNC::Get().GetCurPath() + "/webskins/" + sSkinName;
+        sRet = CZNC::Get().GetCurPath() + "/webskins/" + sSkin;
 
         if (!CFile::IsDir(sRet)) {
-            sRet = CString(_SKINDIR_) + "/" + sSkinName;
+            sRet = CString(_SKINDIR_) + "/" + sSkin;
         }
     }
path: src/WebModules.cpp
Vulnerability: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a NO response without a message.
Vulnerability ID: CVE-2018-14349
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/neomutt/neomutt
Published: 2018-07-17
File: imap/command.c
Commit message: Handle NO response without message properly
Commit author: JerikoOne

Vulnerable version (before fix):
 static int cmd_handle_untagged(struct ImapData *idata)     mutt_debug(2, "Handling untagged NO\n");      /* Display the warning message from the server */     mutt_error("%s", s + 3);   }    return 0;

Fixed version (after fix):
 static int cmd_handle_untagged(struct ImapData *idata)     mutt_debug(2, "Handling untagged NO\n");      /* Display the warning message from the server */     mutt_error("%s", s + 2);   }    return 0;

Patch:
patch: @@ -892,7 +892,7 @@ static int cmd_handle_untagged(struct ImapData *idata)
     mutt_debug(2, "Handling untagged NO\n");
 
     /* Display the warning message from the server */
-    mutt_error("%s", s + 3);
+    mutt_error("%s", s + 2);
   }
 
   return 0;
path: imap/command.c
Vulnerability: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/message.c has a stack-based buffer overflow for a FETCH response with a long INTERNALDATE field.
Vulnerability ID: CVE-2018-14350
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/neomutt/neomutt
Published: 2018-07-17
File: imap/message.c
Commit message: Don't overflow stack buffer in msg_parse_fetch
Commit author: JerikoOne

Vulnerable version (before fix):
 static int msg_parse_fetch(struct ImapHeader *h, char *s)       }       s++;       ptmp = tmp;       while (*s && *s != '\"')         *ptmp++ = *s++;       if (*s != '\"')         return -1; static int msg_parse_fetch(struct ImapHeader *h, char *s)       s += 11;       SKIPWS(s);       ptmp = tmp;       while (isdigit((unsigned char) *s))         *ptmp++ = *s++;       *ptmp = '\0';       if (mutt_str_atol(tmp, &h->content_length) < 0)

Fixed version (after fix):
 static int msg_parse_fetch(struct ImapHeader *h, char *s)       }       s++;       ptmp = tmp;       while (*s && (*s != '\"') && (ptmp != (tmp + sizeof(tmp) - 1)))         *ptmp++ = *s++;       if (*s != '\"')         return -1; static int msg_parse_fetch(struct ImapHeader *h, char *s)       s += 11;       SKIPWS(s);       ptmp = tmp;       while (isdigit((unsigned char) *s) && (ptmp != (tmp + sizeof(tmp) - 1)))         *ptmp++ = *s++;       *ptmp = '\0';       if (mutt_str_atol(tmp, &h->content_length) < 0)

Patch:
patch: @@ -330,7 +330,7 @@ static int msg_parse_fetch(struct ImapHeader *h, char *s)
       }
       s++;
       ptmp = tmp;
-      while (*s && *s != '\"')
+      while (*s && (*s != '\"') && (ptmp != (tmp + sizeof(tmp) - 1)))
         *ptmp++ = *s++;
       if (*s != '\"')
         return -1;
@@ -343,7 +343,7 @@ static int msg_parse_fetch(struct ImapHeader *h, char *s)
       s += 11;
       SKIPWS(s);
       ptmp = tmp;
-      while (isdigit((unsigned char) *s))
+      while (isdigit((unsigned char) *s) && (ptmp != (tmp + sizeof(tmp) - 1)))
         *ptmp++ = *s++;
       *ptmp = '\0';
       if (mutt_str_atol(tmp, &h->content_length) < 0)
path: imap/message.c
Vulnerability: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a long IMAP status mailbox literal count size.
Vulnerability ID: CVE-2018-14351
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/neomutt/neomutt
Published: 2018-07-17
File: imap/command.c
Commit message: Ensure litlen isn't larger than our mailbox
Commit author: JerikoOne

Vulnerable version (before fix):
 static void cmd_parse_status(struct ImapData *idata, char *s)       idata->status = IMAP_FATAL;       return;     }     mailbox = idata->buf;     s = mailbox + litlen;     *s = '\0';

Fixed version (after fix):
 static void cmd_parse_status(struct ImapData *idata, char *s)       idata->status = IMAP_FATAL;       return;     }      if (strlen(idata->buf) < litlen)     {       mutt_debug(1, "Error parsing STATUS mailbox\n");       return;     }      mailbox = idata->buf;     s = mailbox + litlen;     *s = '\0';

Patch:
patch: @@ -635,6 +635,13 @@ static void cmd_parse_status(struct ImapData *idata, char *s)
       idata->status = IMAP_FATAL;
       return;
     }
+
+    if (strlen(idata->buf) < litlen)
+    {
+      mutt_debug(1, "Error parsing STATUS mailbox\n");
+      return;
+    }
+
     mailbox = idata->buf;
     s = mailbox + litlen;
     *s = '\0';
path: imap/command.c
Vulnerability: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap_quote_string in imap/util.c does not leave room for quote characters, leading to a stack-based buffer overflow.
Vulnerability ID: CVE-2018-14352
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/neomutt/neomutt
Published: 2018-07-17
File: imap/util.c
Commit message: imap_quote_string make room for quotes
Commit author: JerikoOne

Vulnerable version (before fix):
 void imap_quote_string(char *dest, size_t dlen, const char *src, bool quote_back   const char *s = src;    *pt++ = '"';   /* save room for trailing quote-char */   dlen -= 2;    for (; *s && dlen; s++)   {

Fixed version (after fix):
 void imap_quote_string(char *dest, size_t dlen, const char *src, bool quote_back   const char *s = src;    *pt++ = '"';   /* save room for quote-chars */   dlen -= 3;    for (; *s && dlen; s++)   {

Patch:
patch: @@ -814,8 +814,8 @@ void imap_quote_string(char *dest, size_t dlen, const char *src, bool quote_back
   const char *s = src;
 
   *pt++ = '"';
-  /* save room for trailing quote-char */
-  dlen -= 2;
+  /* save room for quote-chars */
+  dlen -= 3;
 
   for (; *s && dlen; s++)
   {
path: imap/util.c
Vulnerability: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.
Vulnerability ID: CVE-2018-14354
CWE: CWE-78
Severity score: 6.4
Project: https://github.com/neomutt/neomutt
Published: 2018-07-17
File: imap/imap.c
Commit message: Quote path in imap_subscribe
Commit author: JerikoOne

Vulnerable version (before fix):
 int imap_subscribe(char *path, bool subscribe)   char errstr[STRING];   struct Buffer err, token;   struct ImapMbox mx;    if (!mx_is_imap(path) || imap_parse_path(path, &mx) || !mx.mbox)   { int imap_subscribe(char *path, bool subscribe)     mutt_buffer_init(&err);     err.data = errstr;     err.dsize = sizeof(errstr);     snprintf(mbox, sizeof(mbox), "%smailboxes \"%s\"", subscribe ? "" : "un", path);     if (mutt_parse_rc_line(mbox, &token, &err))       mutt_debug(1, "Error adding subscribed mailbox: %s\n", errstr);     FREE(&token.data);

Fixed version (after fix):
 int imap_subscribe(char *path, bool subscribe)   char errstr[STRING];   struct Buffer err, token;   struct ImapMbox mx;   size_t len = 0;    if (!mx_is_imap(path) || imap_parse_path(path, &mx) || !mx.mbox)   { int imap_subscribe(char *path, bool subscribe)     mutt_buffer_init(&err);     err.data = errstr;     err.dsize = sizeof(errstr); 	len = snprintf(mbox, sizeof(mbox), "%smailboxes ", subscribe ? "" : "un"); 	imap_quote_string(mbox + len, sizeof(mbox) - len, path, true);     if (mutt_parse_rc_line(mbox, &token, &err))       mutt_debug(1, "Error adding subscribed mailbox: %s\n", errstr);     FREE(&token.data);

Patch:
patch: @@ -1709,6 +1709,7 @@ int imap_subscribe(char *path, bool subscribe)
   char errstr[STRING];
   struct Buffer err, token;
   struct ImapMbox mx;
+  size_t len = 0;
 
   if (!mx_is_imap(path) || imap_parse_path(path, &mx) || !mx.mbox)
   {
@@ -1729,7 +1730,8 @@ int imap_subscribe(char *path, bool subscribe)
     mutt_buffer_init(&err);
     err.data = errstr;
     err.dsize = sizeof(errstr);
-    snprintf(mbox, sizeof(mbox), "%smailboxes \"%s\"", subscribe ? "" : "un", path);
+	len = snprintf(mbox, sizeof(mbox), "%smailboxes ", subscribe ? "" : "un");
+	imap_quote_string(mbox + len, sizeof(mbox) - len, path, true);
     if (mutt_parse_rc_line(mbox, &token, &err))
       mutt_debug(1, "Error adding subscribed mailbox: %s\n", errstr);
     FREE(&token.data);
path: imap/imap.c
Vulnerability: An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/util.c mishandles ".." directory traversal in a mailbox name.
Vulnerability ID: CVE-2018-14355
CWE: CWE-22
Severity score: 2.9
Project: https://github.com/neomutt/neomutt
Published: 2018-07-17
File: imap/util.c
Commit message: Selectively cache headers

Co-authored-by: JerikoOne <jeriko.one@gmx.us>
Commit author: Richard Russon

Vulnerable version (before fix):
 header_cache_t *imap_hcache_open(struct ImapData *idata, const char *path)     FREE(&mx.mbox);   }    mutt_account_tourl(&idata->conn->account, &url);   url.path = mbox;   url_tostring(&url, cachepath, sizeof(cachepath), U_PATH);

Fixed version (after fix):
 header_cache_t *imap_hcache_open(struct ImapData *idata, const char *path)     FREE(&mx.mbox);   }    if (strstr(mbox, "/../") || (strcmp(mbox, "..") == 0) || (strncmp(mbox, "../", 3) == 0))     return NULL;   size_t len = strlen(mbox);   if ((len > 3) && (strcmp(mbox + len - 3, "/..") == 0))     return NULL;    mutt_account_tourl(&idata->conn->account, &url);   url.path = mbox;   url_tostring(&url, cachepath, sizeof(cachepath), U_PATH);

Patch:
patch: @@ -245,6 +245,12 @@ header_cache_t *imap_hcache_open(struct ImapData *idata, const char *path)
     FREE(&mx.mbox);
   }
 
+  if (strstr(mbox, "/../") || (strcmp(mbox, "..") == 0) || (strncmp(mbox, "../", 3) == 0))
+    return NULL;
+  size_t len = strlen(mbox);
+  if ((len > 3) && (strcmp(mbox + len - 3, "/..") == 0))
+    return NULL;
+
   mutt_account_tourl(&idata->conn->account, &url);
   url.path = mbox;
   url_tostring(&url, cachepath, sizeof(cachepath), U_PATH);
path: imap/util.c