rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The vivid_fb_ioctl function in drivers/media/platform/vivid/vivid-osd.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a crafted application.
Vulnerability ID: CVE-2015-7884
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2015-12-28
File: drivers/media/platform/vivid/vivid-osd.c
Commit message: [media] media/vivid-osd: fix info leak in ioctl

The vivid_fb_ioctl() code fails to initialize the 16 _reserved bytes of
struct fb_vblank after the ->hcount member. Add an explicit
memset(0) before filling the structure to avoid the info leak.

Signed-off-by: Salva Peiró <speirofr@gmail.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Commit author: Salva Peiró

Vulnerable version (before fix):
 static int vivid_fb_ioctl(struct fb_info *info, unsigned cmd, unsigned long arg) 	case FBIOGET_VBLANK: { 		struct fb_vblank vblank;  		vblank.flags = FB_VBLANK_HAVE_COUNT | FB_VBLANK_HAVE_VCOUNT | 			FB_VBLANK_HAVE_VSYNC; 		vblank.count = 0;

Fixed version (after fix):
 static int vivid_fb_ioctl(struct fb_info *info, unsigned cmd, unsigned long arg) 	case FBIOGET_VBLANK: { 		struct fb_vblank vblank;  		memset(&vblank, 0, sizeof(vblank)); 		vblank.flags = FB_VBLANK_HAVE_COUNT | FB_VBLANK_HAVE_VCOUNT | 			FB_VBLANK_HAVE_VSYNC; 		vblank.count = 0;

Patch:
patch: @@ -85,6 +85,7 @@ static int vivid_fb_ioctl(struct fb_info *info, unsigned cmd, unsigned long arg)
 	case FBIOGET_VBLANK: {
 		struct fb_vblank vblank;
 
+		memset(&vblank, 0, sizeof(vblank));
 		vblank.flags = FB_VBLANK_HAVE_COUNT | FB_VBLANK_HAVE_VCOUNT |
 			FB_VBLANK_HAVE_VSYNC;
 		vblank.count = 0;
path: drivers/media/platform/vivid/vivid-osd.c
Vulnerability: The dgnc_mgmt_ioctl function in drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a crafted application.
Vulnerability ID: CVE-2015-7885
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2015-12-28
File: drivers/staging/dgnc/dgnc_mgmt.c
Commit message: staging/dgnc: fix info leak in ioctl

The dgnc_mgmt_ioctl() code fails to initialize the 16 _reserved bytes of
struct digi_dinfo after the ->dinfo_nboards member. Add an explicit
memset(0) before filling the structure to avoid the info leak.

Signed-off-by: Salva Peiró <speirofr@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Commit author: Salva Peiró

Vulnerable version (before fix):
 long dgnc_mgmt_ioctl(struct file *file, unsigned int cmd, unsigned long arg)  		spin_lock_irqsave(&dgnc_global_lock, flags);  		ddi.dinfo_nboards = dgnc_NumBoards; 		sprintf(ddi.dinfo_version, "%s", DG_PART); 

Fixed version (after fix):
 long dgnc_mgmt_ioctl(struct file *file, unsigned int cmd, unsigned long arg)  		spin_lock_irqsave(&dgnc_global_lock, flags);  		memset(&ddi, 0, sizeof(ddi)); 		ddi.dinfo_nboards = dgnc_NumBoards; 		sprintf(ddi.dinfo_version, "%s", DG_PART); 

Patch:
patch: @@ -110,6 +110,7 @@ long dgnc_mgmt_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 
 		spin_lock_irqsave(&dgnc_global_lock, flags);
 
+		memset(&ddi, 0, sizeof(ddi));
 		ddi.dinfo_nboards = dgnc_NumBoards;
 		sprintf(ddi.dinfo_version, "%s", DG_PART);
path: drivers/staging/dgnc/dgnc_mgmt.c
Vulnerability: The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.
Vulnerability ID: CVE-2015-8569
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2015-12-28
File: drivers/net/ppp/pptp.c
Commit message: pptp: verify sockaddr_len in pptp_bind() and pptp_connect()

Reported-by: Dmitry Vyukov <dvyukov@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: WANG Cong

Vulnerable version (before fix):
 static int pptp_bind(struct socket *sock, struct sockaddr *uservaddr, 	struct pptp_opt *opt = &po->proto.pptp; 	int error = 0;  	lock_sock(sk);  	opt->src_addr = sp->sa_addr.pptp; static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr, 	struct flowi4 fl4; 	int error = 0;  	if (sp->sa_protocol != PX_PROTO_PPTP) 		return -EINVAL; 

Fixed version (after fix):
 static int pptp_bind(struct socket *sock, struct sockaddr *uservaddr, 	struct pptp_opt *opt = &po->proto.pptp; 	int error = 0;  	if (sockaddr_len < sizeof(struct sockaddr_pppox)) 		return -EINVAL;  	lock_sock(sk);  	opt->src_addr = sp->sa_addr.pptp; static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr, 	struct flowi4 fl4; 	int error = 0;  	if (sockaddr_len < sizeof(struct sockaddr_pppox)) 		return -EINVAL;  	if (sp->sa_protocol != PX_PROTO_PPTP) 		return -EINVAL; 

Patch:
patch: @@ -419,6 +419,9 @@ static int pptp_bind(struct socket *sock, struct sockaddr *uservaddr,
 	struct pptp_opt *opt = &po->proto.pptp;
 	int error = 0;
 
+	if (sockaddr_len < sizeof(struct sockaddr_pppox))
+		return -EINVAL;
+
 	lock_sock(sk);
 
 	opt->src_addr = sp->sa_addr.pptp;
@@ -440,6 +443,9 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr,
 	struct flowi4 fl4;
 	int error = 0;
 
+	if (sockaddr_len < sizeof(struct sockaddr_pppox))
+		return -EINVAL;
+
 	if (sp->sa_protocol != PX_PROTO_PPTP)
 		return -EINVAL;
path: drivers/net/ppp/pptp.c
Vulnerability: The sco_sock_bind function in net/bluetooth/sco.c in the Linux kernel before 4.3.4 does not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.
Vulnerability ID: CVE-2015-8575
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2016-02-08
File: net/bluetooth/sco.c
Commit message: bluetooth: Validate socket address length in sco_sock_bind().

Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: David S. Miller

Vulnerable version (before fix):
 static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, 	if (!addr || addr->sa_family != AF_BLUETOOTH) 		return -EINVAL;  	lock_sock(sk);  	if (sk->sk_state != BT_OPEN) {

Fixed version (after fix):
 static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, 	if (!addr || addr->sa_family != AF_BLUETOOTH) 		return -EINVAL;  	if (addr_len < sizeof(struct sockaddr_sco)) 		return -EINVAL;  	lock_sock(sk);  	if (sk->sk_state != BT_OPEN) {

Patch:
patch: @@ -526,6 +526,9 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr,
 	if (!addr || addr->sa_family != AF_BLUETOOTH)
 		return -EINVAL;
 
+	if (addr_len < sizeof(struct sockaddr_sco))
+		return -EINVAL;
+
 	lock_sock(sk);
 
 	if (sk->sk_state != BT_OPEN) {
path: net/bluetooth/sco.c
Vulnerability: The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted string.
Vulnerability ID: CVE-2015-8629
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/krb5/krb5
Published: 2016-02-13
File: src/lib/kadm5/kadm_rpc_xdr.c
Commit message: Verify decoded kadmin C strings [CVE-2015-8629]

In xdr_nullstring(), check that the decoded string is terminated with
a zero byte and does not contain any internal zero bytes.

CVE-2015-8629:

In all versions of MIT krb5, an authenticated attacker can cause
kadmind to read beyond the end of allocated memory by sending a string
without a terminating zero byte.  Information leakage may be possible
for an attacker with permission to modify the database.

    CVSSv2 Vector: AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C

ticket: 8341 (new)
target_version: 1.14-next
target_version: 1.13-next
tags: pullup
Commit author: Greg Hudson

Vulnerable version (before fix):
 bool_t xdr_nullstring(XDR *xdrs, char **objp) 		    return FALSE; 	       } 	  } 	  return (xdr_opaque(xdrs, *objp, size));       case XDR_ENCODE: 	  if (size != 0)

Fixed version (after fix):
 bool_t xdr_nullstring(XDR *xdrs, char **objp) 		    return FALSE; 	       } 	  } 	  if (!xdr_opaque(xdrs, *objp, size)) 		  return FALSE; 	  /* Check that the unmarshalled bytes are a C string. */ 	  if ((*objp)[size - 1] != '\0') 		  return FALSE; 	  if (memchr(*objp, '\0', size - 1) != NULL) 		  return FALSE; 	  return TRUE;       case XDR_ENCODE: 	  if (size != 0)

Patch:
patch: @@ -64,7 +64,14 @@ bool_t xdr_nullstring(XDR *xdrs, char **objp)
 		    return FALSE;
 	       }
 	  }
-	  return (xdr_opaque(xdrs, *objp, size));
+	  if (!xdr_opaque(xdrs, *objp, size))
+		  return FALSE;
+	  /* Check that the unmarshalled bytes are a C string. */
+	  if ((*objp)[size - 1] != '\0')
+		  return FALSE;
+	  if (memchr(*objp, '\0', size - 1) != NULL)
+		  return FALSE;
+	  return TRUE;
 
      case XDR_ENCODE:
 	  if (size != 0)
path: src/lib/kadm5/kadm_rpc_xdr.c
Vulnerability: The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.
Vulnerability ID: CVE-2015-8660
CWE: CWE-264
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2015-12-28
File: fs/overlayfs/inode.c
Commit message: ovl: fix permission checking for setattr

[Al Viro] The bug is in being too enthusiastic about optimizing ->setattr()
away - instead of "copy verbatim with metadata" + "chmod/chown/utimes"
(with the former being always safe and the latter failing in case of
insufficient permissions) it tries to combine these two.  Note that copyup
itself will have to do ->setattr() anyway; _that_ is where the elevated
capabilities are right.  Having these two ->setattr() (one to set verbatim
copy of metadata, another to do what overlayfs ->setattr() had been asked
to do in the first place) combined is where it breaks.

Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Cc: <stable@vger.kernel.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Commit author: Miklos Szeredi

Vulnerable version (before fix):
 int ovl_setattr(struct dentry *dentry, struct iattr *attr) 	if (err) 		goto out;  	upperdentry = ovl_dentry_upper(dentry); 	if (upperdentry) { 		mutex_lock(&upperdentry->d_inode->i_mutex); 		err = notify_change(upperdentry, attr, NULL); 		mutex_unlock(&upperdentry->d_inode->i_mutex); 	} else { 		err = ovl_copy_up_last(dentry, attr, false); 	} 	ovl_drop_write(dentry); out:

Fixed version (after fix):
 int ovl_setattr(struct dentry *dentry, struct iattr *attr) 	if (err) 		goto out;  	err = ovl_copy_up(dentry); 	if (!err) { 		upperdentry = ovl_dentry_upper(dentry);  		mutex_lock(&upperdentry->d_inode->i_mutex); 		err = notify_change(upperdentry, attr, NULL); 		mutex_unlock(&upperdentry->d_inode->i_mutex); 	} 	ovl_drop_write(dentry); out:

Patch:
patch: @@ -49,13 +49,13 @@ int ovl_setattr(struct dentry *dentry, struct iattr *attr)
 	if (err)
 		goto out;
 
-	upperdentry = ovl_dentry_upper(dentry);
-	if (upperdentry) {
+	err = ovl_copy_up(dentry);
+	if (!err) {
+		upperdentry = ovl_dentry_upper(dentry);
+
 		mutex_lock(&upperdentry->d_inode->i_mutex);
 		err = notify_change(upperdentry, attr, NULL);
 		mutex_unlock(&upperdentry->d_inode->i_mutex);
-	} else {
-		err = ovl_copy_up_last(dentry, attr, false);
 	}
 	ovl_drop_write(dentry);
 out:
path: fs/overlayfs/inode.c
Vulnerability: The DNS::GetResult function in dns.cpp in InspIRCd before 2.0.19 allows remote DNS servers to cause a denial of service (netsplit) via an invalid character in a PTR response, as demonstrated by a "\032" (whitespace) character in a hostname.
Vulnerability ID: CVE-2015-8702
CWE: CWE-20
Severity score: 6.9
Project: https://github.com/inspircd/inspircd
Published: 2016-04-12
File: src/dns.cpp
Commit message: Reject replies to DNS PTR requests that contain invalid characters

Fixes issue #1033 reported by @ping86
Commit author: Attila Molnar

Vulnerable version (before fix):
 DNSResult DNS::GetResult() 				/* Identical handling to PTR */  			case DNS_QUERY_PTR: 				/* Reverse lookups just come back as char* */ 				resultstr = std::string((const char*)data.first); 			break;  			default:

Fixed version (after fix):
 DNSResult DNS::GetResult() 				/* Identical handling to PTR */  			case DNS_QUERY_PTR: 			{ 				/* Reverse lookups just come back as char* */ 				resultstr = std::string((const char*)data.first); 				if (resultstr.find_first_not_of("0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ.-") != std::string::npos) 				{ 					std::string ro = req->orig; 					delete req; 					return DNSResult(this_id | ERROR_MASK, "Invalid char(s) in reply", 0, ro); 				} 			} 			break;  			default:

Patch:
patch: @@ -700,8 +700,16 @@ DNSResult DNS::GetResult()
 				/* Identical handling to PTR */
 
 			case DNS_QUERY_PTR:
+			{
 				/* Reverse lookups just come back as char* */
 				resultstr = std::string((const char*)data.first);
+				if (resultstr.find_first_not_of("0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ.-") != std::string::npos)
+				{
+					std::string ro = req->orig;
+					delete req;
+					return DNSResult(this_id | ERROR_MASK, "Invalid char(s) in reply", 0, ro);
+				}
+			}
 			break;
 
 			default:
path: src/dns.cpp
Vulnerability: Cross-site scripting (XSS) vulnerability in the _renderVarInput_number function in horde/framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php in Horde Groupware before 5.2.12 and Horde Groupware Webmail Edition before 5.2.12 allows remote attackers to inject arbitrary web script or HTML via vectors involving numeric form fields.
Vulnerability ID: CVE-2015-8807
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/horde/horde
Published: 2016-04-13
File: framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php
Commit message: Escape form value.

Even though this is a numeric field, this isn't enforced until
the form is submitted.
Commit author: Michael J Rubinsky

Vulnerable version (before fix):
 protected function _renderVarInput_number($form, &$var, &$vars)         return sprintf('<input type="text" size="5" name="%s" id="%s" value="%s"%s />',                        htmlspecialchars($var->getVarName()),                        $this->_genID($var->getVarName(), false),                        $value,                        $this->_getActionScripts($form, $var)                );     }

Fixed version (after fix):
 protected function _renderVarInput_number($form, &$var, &$vars)         return sprintf('<input type="text" size="5" name="%s" id="%s" value="%s"%s />',                        htmlspecialchars($var->getVarName()),                        $this->_genID($var->getVarName(), false),                        htmlspecialchars($value),                        $this->_getActionScripts($form, $var)                );     }

Patch:
patch: @@ -48,7 +48,7 @@ protected function _renderVarInput_number($form, &$var, &$vars)
         return sprintf('<input type="text" size="5" name="%s" id="%s" value="%s"%s />',
                        htmlspecialchars($var->getVarName()),
                        $this->_genID($var->getVarName(), false),
-                       $value,
+                       htmlspecialchars($value),
                        $this->_getActionScripts($form, $var)
                );
     }
path: framework/Core/lib/Horde/Core/Ui/VarRenderer/Html.php
Vulnerability: Off-by-one error in the tokenadd function in jv_parse.c in jq allows remote attackers to cause a denial of service (crash) via a long JSON-encoded number, which triggers a heap-based buffer overflow.
Vulnerability ID: CVE-2015-8863
CWE: CWE-119
Severity score: 10
Project: https://github.com/stedolan/jq
Published: 2016-05-06
File: src/jv_parse.c
Commit message: Heap buffer overflow in tokenadd() (fix #105)

This was an off-by one: the NUL terminator byte was not allocated on
resize.  This was triggered by JSON-encoded numbers longer than 256
bytes.
Commit author: Nicolas Williams

Vulnerable version (before fix):
 static pfunc stream_token(struct jv_parser* p, char ch) {  static void tokenadd(struct jv_parser* p, char c) {   assert(p->tokenpos <= p->tokenlen);   if (p->tokenpos == p->tokenlen) {     p->tokenlen = p->tokenlen*2 + 256;     p->tokenbuf = jv_mem_realloc(p->tokenbuf, p->tokenlen);   } static pfunc check_literal(struct jv_parser* p) {     TRY(value(p, v));   } else {     // FIXME: better parser     p->tokenbuf[p->tokenpos] = 0; // FIXME: invalid     char* end = 0;     double d = jvp_strtod(&p->dtoa, p->tokenbuf, &end);     if (end == 0 || *end != 0)

Fixed version (after fix):
 static pfunc stream_token(struct jv_parser* p, char ch) {  static void tokenadd(struct jv_parser* p, char c) {   assert(p->tokenpos <= p->tokenlen);   if (p->tokenpos >= (p->tokenlen - 1)) {     p->tokenlen = p->tokenlen*2 + 256;     p->tokenbuf = jv_mem_realloc(p->tokenbuf, p->tokenlen);   } static pfunc check_literal(struct jv_parser* p) {     TRY(value(p, v));   } else {     // FIXME: better parser     p->tokenbuf[p->tokenpos] = 0;     char* end = 0;     double d = jvp_strtod(&p->dtoa, p->tokenbuf, &end);     if (end == 0 || *end != 0)

Patch:
patch: @@ -383,7 +383,7 @@ static pfunc stream_token(struct jv_parser* p, char ch) {
 
 static void tokenadd(struct jv_parser* p, char c) {
   assert(p->tokenpos <= p->tokenlen);
-  if (p->tokenpos == p->tokenlen) {
+  if (p->tokenpos >= (p->tokenlen - 1)) {
     p->tokenlen = p->tokenlen*2 + 256;
     p->tokenbuf = jv_mem_realloc(p->tokenbuf, p->tokenlen);
   }
@@ -485,7 +485,7 @@ static pfunc check_literal(struct jv_parser* p) {
     TRY(value(p, v));
   } else {
     // FIXME: better parser
-    p->tokenbuf[p->tokenpos] = 0; // FIXME: invalid
+    p->tokenbuf[p->tokenpos] = 0;
     char* end = 0;
     double d = jvp_strtod(&p->dtoa, p->tokenbuf, &end);
     if (end == 0 || *end != 0)
path: src/jv_parse.c
Vulnerability: The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file.
Vulnerability ID: CVE-2015-8865
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/file/file
Published: 2016-05-20
File: src/funcs.c
Commit message: PR/454: Fix memory corruption when the continuation level jumps by more than
20 in a single step.
Commit author: Christos Zoulas

Vulnerable version (before fix):
 #include "file.h"  #ifndef	lint FILE_RCSID("@(#)$File: funcs.c,v 1.80 2015/01/02 21:29:39 christos Exp $") #endif	/* lint */  #include "magic.h" file_check_mem(struct magic_set *ms, unsigned int level) 	size_t len;  	if (level >= ms->c.len) { 		len = (ms->c.len += 20) * sizeof(*ms->c.li); 		ms->c.li = CAST(struct level_info *, (ms->c.li == NULL) ? 		    malloc(len) : 		    realloc(ms->c.li, len));

Fixed version (after fix):
 #include "file.h"  #ifndef	lint FILE_RCSID("@(#)$File: funcs.c,v 1.81 2015/05/28 19:26:59 christos Exp $") #endif	/* lint */  #include "magic.h" file_check_mem(struct magic_set *ms, unsigned int level) 	size_t len;  	if (level >= ms->c.len) { 		len = (ms->c.len = 20 + level) * sizeof(*ms->c.li); 		ms->c.li = CAST(struct level_info *, (ms->c.li == NULL) ? 		    malloc(len) : 		    realloc(ms->c.li, len));

Patch:
patch: @@ -27,7 +27,7 @@
 #include "file.h"
 
 #ifndef	lint
-FILE_RCSID("@(#)$File: funcs.c,v 1.80 2015/01/02 21:29:39 christos Exp $")
+FILE_RCSID("@(#)$File: funcs.c,v 1.81 2015/05/28 19:26:59 christos Exp $")
 #endif	/* lint */
 
 #include "magic.h"
@@ -416,7 +416,7 @@ file_check_mem(struct magic_set *ms, unsigned int level)
 	size_t len;
 
 	if (level >= ms->c.len) {
-		len = (ms->c.len += 20) * sizeof(*ms->c.li);
+		len = (ms->c.len = 20 + level) * sizeof(*ms->c.li);
 		ms->c.li = CAST(struct level_info *, (ms->c.li == NULL) ?
 		    malloc(len) :
 		    realloc(ms->c.li, len));
path: src/funcs.c
Vulnerability: The set_fat function in fat.c in dosfstools before 4.0 might allow attackers to corrupt a FAT12 filesystem or cause a denial of service (invalid memory read and crash) by writing an odd number of clusters to the third to last entry on a FAT12 filesystem, which triggers an "off-by-two error."
Vulnerability ID: CVE-2015-8872
CWE: CWE-189
Severity score: 2.9
Project: https://github.com/dosfstools/dosfstools
Published: 2016-06-03
File: src/fat.c
Commit message: set_fat(): Fix off-by-2 error leading to corruption in FAT12

In FAT12 two 12 bit entries are combined to a 24 bit value (three
bytes). Therefore, when an even numbered FAT entry is set in FAT12, it
must be be combined with the following entry. To prevent accessing
beyond the end of the FAT array, it must be checked that the cluster is
not the last one.

Previously, the check tested that the requested cluster was equal to
fs->clusters - 1. However, fs->clusters is the number of data clusters
not including the two reserved FAT entries at the start so the test
triggered two clusters early.

If the third to last entry was written on a FAT12 filesystem with an
odd number of clusters, the second to last entry would be corrupted.
This corruption may also lead to invalid memory accesses when the
corrupted entry becomes out of bounds and is used later.

Change the test to fs->clusters + 1 to fix.

Reported-by: Hanno Böck
Signed-off-by: Andreas Bombe <aeb@debian.org>
Commit author: Andreas Bombe

Vulnerable version (before fix):
 void set_fat(DOS_FS * fs, uint32_t cluster, int32_t new) 	    data[1] = new >> 4; 	} else { 	    FAT_ENTRY subseqEntry; 	    if (cluster != fs->clusters - 1) 		get_fat(&subseqEntry, fs->fat, cluster + 1, fs); 	    else 		subseqEntry.value = 0;

Fixed version (after fix):
 void set_fat(DOS_FS * fs, uint32_t cluster, int32_t new) 	    data[1] = new >> 4; 	} else { 	    FAT_ENTRY subseqEntry; 	    if (cluster != fs->clusters + 1) 		get_fat(&subseqEntry, fs->fat, cluster + 1, fs); 	    else 		subseqEntry.value = 0;

Patch:
patch: @@ -205,7 +205,7 @@ void set_fat(DOS_FS * fs, uint32_t cluster, int32_t new)
 	    data[1] = new >> 4;
 	} else {
 	    FAT_ENTRY subseqEntry;
-	    if (cluster != fs->clusters - 1)
+	    if (cluster != fs->clusters + 1)
 		get_fat(&subseqEntry, fs->fat, cluster + 1, fs);
 	    else
 		subseqEntry.value = 0;
path: src/fat.c
Vulnerability: The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function.
Vulnerability ID: CVE-2015-8877
CWE: CWE-399
Severity score: 2.9
Project: https://github.com/libgd/libgd
Published: 2016-05-22
File: src/gd_interpolation.c
Commit message: gdImageScaleTwoPass memory leak fix

Fixing memory leak in gdImageScaleTwoPass, as reported by @cmb69 and
confirmed by @vapier.  This bug actually bit me in production and I'm
very thankful that it was reported with an easy fix.

Fixes #173.
Commit author: Vladimir Mitrovic

Vulnerable version (before fix):
 gdImageScaleTwoPass(const gdImagePtr src, const unsigned int new_width,     }/* if */      if (src != tmp_im) {         gdFree(tmp_im);     }/* if */  	return dst;

Fixed version (after fix):
 gdImageScaleTwoPass(const gdImagePtr src, const unsigned int new_width,     }/* if */      if (src != tmp_im) {         gdImageDestroy(tmp_im);     }/* if */  	return dst;

Patch:
patch: @@ -1087,7 +1087,7 @@ gdImageScaleTwoPass(const gdImagePtr src, const unsigned int new_width,
     }/* if */
 
     if (src != tmp_im) {
-        gdFree(tmp_im);
+        gdImageDestroy(tmp_im);
     }/* if */
 
 	return dst;
path: src/gd_interpolation.c