rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be triggered from unprivileged userspace during a core dump on a POWER host due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path, leading to a denial of service.
Vulnerability ID: CVE-2018-1091
CWE: CWE-119
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2018-03-27
File: arch/powerpc/kernel/ptrace.c
Commit message: powerpc/tm: Flush TM only if CPU has TM feature

Commit cd63f3c ("powerpc/tm: Fix saving of TM SPRs in core dump")
added code to access TM SPRs in flush_tmregs_to_thread(). However
flush_tmregs_to_thread() does not check if TM feature is available on
CPU before trying to access TM SPRs in order to copy live state to
thread structures. flush_tmregs_to_thread() is indeed guarded by
CONFIG_PPC_TRANSACTIONAL_MEM but it might be the case that kernel
was compiled with CONFIG_PPC_TRANSACTIONAL_MEM enabled and ran on
a CPU without TM feature available, thus rendering the execution
of TM instructions that are treated by the CPU as illegal instructions.

The fix is just to add proper checking in flush_tmregs_to_thread()
if CPU has the TM feature before accessing any TM-specific resource,
returning immediately if TM is no available on the CPU. Adding
that checking in flush_tmregs_to_thread() instead of in places
where it is called, like in vsr_get() and vsr_set(), is better because
avoids the same problem cropping up elsewhere.

Cc: stable@vger.kernel.org # v4.13+
Fixes: cd63f3c ("powerpc/tm: Fix saving of TM SPRs in core dump")
Signed-off-by: Gustavo Romero <gromero@linux.vnet.ibm.com>
Reviewed-by: Cyril Bur <cyrilbur@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Commit author: Gustavo Romero

Vulnerable version (before fix):
 static void flush_tmregs_to_thread(struct task_struct *tsk) 	 * in the appropriate thread structures from live. 	 */  	if (tsk != current) 		return;  	if (MSR_TM_SUSPENDED(mfmsr())) {

Fixed version (after fix):
 static void flush_tmregs_to_thread(struct task_struct *tsk) 	 * in the appropriate thread structures from live. 	 */  	if ((!cpu_has_feature(CPU_FTR_TM)) || (tsk != current)) 		return;  	if (MSR_TM_SUSPENDED(mfmsr())) {

Patch:
patch: @@ -131,7 +131,7 @@ static void flush_tmregs_to_thread(struct task_struct *tsk)
 	 * in the appropriate thread structures from live.
 	 */
 
-	if (tsk != current)
+	if ((!cpu_has_feature(CPU_FTR_TM)) || (tsk != current))
 		return;
 
 	if (MSR_TM_SUSPENDED(mfmsr())) {
path: arch/powerpc/kernel/ptrace.c
Vulnerability: The cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c in the Linux kernel before 4.16.6 allows local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out kernel memory.
Vulnerability ID: CVE-2018-10940
CWE: CWE-119
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2018-05-09
File: drivers/cdrom/cdrom.c
Commit message: cdrom: information leak in cdrom_ioctl_media_changed()

This cast is wrong.  "cdi->capacity" is an int and "arg" is an unsigned
long.  The way the check is written now, if one of the high 32 bits is
set then we could read outside the info->slots[] array.

This bug is pretty old and it predates git.

Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Commit author: Dan Carpenter

Vulnerable version (before fix):
 static int cdrom_ioctl_media_changed(struct cdrom_device_info *cdi, 	if (!CDROM_CAN(CDC_SELECT_DISC) || arg == CDSL_CURRENT) 		return media_changed(cdi, 1);  	if ((unsigned int)arg >= cdi->capacity) 		return -EINVAL;  	info = kmalloc(sizeof(*info), GFP_KERNEL);

Fixed version (after fix):
 static int cdrom_ioctl_media_changed(struct cdrom_device_info *cdi, 	if (!CDROM_CAN(CDC_SELECT_DISC) || arg == CDSL_CURRENT) 		return media_changed(cdi, 1);  	if (arg >= cdi->capacity) 		return -EINVAL;  	info = kmalloc(sizeof(*info), GFP_KERNEL);

Patch:
patch: @@ -2371,7 +2371,7 @@ static int cdrom_ioctl_media_changed(struct cdrom_device_info *cdi,
 	if (!CDROM_CAN(CDC_SELECT_DISC) || arg == CDSL_CURRENT)
 		return media_changed(cdi, 1);
 
-	if ((unsigned int)arg >= cdi->capacity)
+	if (arg >= cdi->capacity)
 		return -EINVAL;
 
 	info = kmalloc(sizeof(*info), GFP_KERNEL);
path: drivers/cdrom/cdrom.c
Vulnerability: js/views/message_view.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL.
Vulnerability ID: CVE-2018-10994
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/signalapp/Signal-Desktop
Published: 2018-05-14
File: js/views/message_view.js
Commit message: Update link handling
Commit author: Scott Nonnenberg

Vulnerable version (before fix):
    window.Whisper = window.Whisper || {};    const ErrorIconView = Whisper.View.extend({     templateName: 'error-icon',     className: 'error-icon-container',        if (body.length > 0) {         const escapedBody = body.html();         body.html(Signal.HTML.render(escapedBody));       }        this.renderSent();

Fixed version (after fix):
    window.Whisper = window.Whisper || {};    const URL_REGEX = /(^|[\s\n]|<br\/?>)((?:https?|ftp):\/\/[-A-Z0-9\u00A0-\uD7FF\uE000-\uFDCF\uFDF0-\uFFFD+\u0026\u2019@#/%?=()~_|!:,.;]*[-A-Z0-9+\u0026@#/%=~()_|])/gi;    const ErrorIconView = Whisper.View.extend({     templateName: 'error-icon',     className: 'error-icon-container',        if (body.length > 0) {         const escapedBody = body.html();         body.html(           escapedBody             .replace(/\n/g, '<br>')             .replace(URL_REGEX, "$1<a href='$2' target='_blank'>$2</a>")         );       }        this.renderSent();

Patch:
patch: @@ -15,6 +15,8 @@
 
   window.Whisper = window.Whisper || {};
 
+  const URL_REGEX = /(^|[\s\n]|<br\/?>)((?:https?|ftp):\/\/[-A-Z0-9\u00A0-\uD7FF\uE000-\uFDCF\uFDF0-\uFFFD+\u0026\u2019@#/%?=()~_|!:,.;]*[-A-Z0-9+\u0026@#/%=~()_|])/gi;
+
   const ErrorIconView = Whisper.View.extend({
     templateName: 'error-icon',
     className: 'error-icon-container',
@@ -508,7 +510,11 @@
 
       if (body.length > 0) {
         const escapedBody = body.html();
-        body.html(Signal.HTML.render(escapedBody));
+        body.html(
+          escapedBody
+            .replace(/\n/g, '<br>')
+            .replace(URL_REGEX, "$1<a href='$2' target='_blank'>$2</a>")
+        );
       }
 
       this.renderSent();
path: js/views/message_view.js
Vulnerability: Services/Feeds/classes/class.ilExternalFeedItem.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS via a link attribute.
Vulnerability ID: CVE-2018-11117
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/ILIAS-eLearning/ILIAS
Published: 2018-05-17
File: Services/Feeds/classes/class.ilExternalFeedItem.php
Commit message: fixed 23026: link attribute
Commit author: Alexander Killing

Vulnerable version (before fix):
 function setMagpieItem($a_item) 		if (isset($a_item["link_"])) 		{ 			$this->setLink( 				ilUtil::secureLink($this->secureString($a_item["link_"]))); 		} 		else 		{ 			if (isset($a_item["link"])) 			{ 				$this->setLink( 					ilUtil::secureLink($this->secureString($a_item["link"]))); 			} 		} 		 		// summary 		if (isset($a_item["atom_content"])) 		{

Fixed version (after fix):
 function setMagpieItem($a_item) 		if (isset($a_item["link_"])) 		{ 			$this->setLink( 				ilUtil::secureUrl(ilUtil::secureLink($this->secureString($a_item["link_"])))); 		} 		else 		{ 			if (isset($a_item["link"])) 			{ 				$this->setLink( 					ilUtil::secureUrl(ilUtil::secureLink($this->secureString($a_item["link"])))); 			} 		} 		// summary 		if (isset($a_item["atom_content"])) 		{

Patch:
patch: @@ -32,17 +32,16 @@ function setMagpieItem($a_item)
 		if (isset($a_item["link_"]))
 		{
 			$this->setLink(
-				ilUtil::secureLink($this->secureString($a_item["link_"])));
+				ilUtil::secureUrl(ilUtil::secureLink($this->secureString($a_item["link_"]))));
 		}
 		else
 		{
 			if (isset($a_item["link"]))
 			{
 				$this->setLink(
-					ilUtil::secureLink($this->secureString($a_item["link"])));
+					ilUtil::secureUrl(ilUtil::secureLink($this->secureString($a_item["link"]))));
 			}
 		}
-		
 		// summary
 		if (isset($a_item["atom_content"]))
 		{
path: Services/Feeds/classes/class.ilExternalFeedItem.php
Vulnerability: Services/COPage/classes/class.ilPCSourceCode.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS.
Vulnerability ID: CVE-2018-11120
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/ILIAS-eLearning/ILIAS
Published: 2018-05-17
File: Services/COPage/classes/class.ilPCSourceCode.php
Commit message: fixed bug #23028: html handling
Commit author: Alexander Killing

Vulnerable version (before fix):
 function modifyPageContentPostXsl($a_output, $outputmode = "presentation") 			$content = str_replace("<br/>", "\n", $content); 			$rownums = count(explode("\n",$content));  			$plain_content = html_entity_decode($content); 			$plain_content = preg_replace_callback(                 "/\&#x([1-9a-f]{2});?/is",                 function($hit) {

Fixed version (after fix):
 function modifyPageContentPostXsl($a_output, $outputmode = "presentation") 			$content = str_replace("<br/>", "\n", $content); 			$rownums = count(explode("\n",$content));  			// see #23028 			//$plain_content = html_entity_decode($content); 			$plain_content = $content;  			$plain_content = preg_replace_callback(                 "/\&#x([1-9a-f]{2});?/is",                 function($hit) {

Patch:
patch: @@ -81,7 +81,10 @@ function modifyPageContentPostXsl($a_output, $outputmode = "presentation")
 			$content = str_replace("<br/>", "\n", $content);
 			$rownums = count(explode("\n",$content));
 
-			$plain_content = html_entity_decode($content);
+			// see #23028
+			//$plain_content = html_entity_decode($content);
+			$plain_content = $content;
+
 			$plain_content = preg_replace_callback(
                 "/\&#x([1-9a-f]{2});?/is",
                 function($hit) {
path: Services/COPage/classes/class.ilPCSourceCode.php
Vulnerability: app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes.
Vulnerability ID: CVE-2018-11245
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/MISP/MISP
Published: 2018-05-18
File: app/webroot/js/misp.js
Commit message: fix: Fixed a DOM based XSS with cortex type attributes

- as reported by Dawid Czarnecki (dawid@pz.pl)
Commit author: iglocska

Vulnerable version (before fix):
 function submitMISPUpdate() {  $(".cortex-json").click(function() { 	var cortex_data = $(this).data('cortex-json'); 	cortex_data = JSON.stringify(cortex_data, null, 2); 	var popupHtml = '<pre class="simplepre">' + cortex_data + '</pre>'; 	popupHtml += '<div class="close-icon useCursorPointer" onClick="closeScreenshot();"></div>'; 	$('#screenshot_box').html(popupHtml);

Fixed version (after fix):
 function submitMISPUpdate() {  $(".cortex-json").click(function() { 	var cortex_data = $(this).data('cortex-json'); 	cortex_data = htmlEncode(JSON.stringify(cortex_data, null, 2)); 	var popupHtml = '<pre class="simplepre">' + cortex_data + '</pre>'; 	popupHtml += '<div class="close-icon useCursorPointer" onClick="closeScreenshot();"></div>'; 	$('#screenshot_box').html(popupHtml);

Patch:
patch: @@ -3160,7 +3160,7 @@ function submitMISPUpdate() {
 
 $(".cortex-json").click(function() {
 	var cortex_data = $(this).data('cortex-json');
-	cortex_data = JSON.stringify(cortex_data, null, 2);
+	cortex_data = htmlEncode(JSON.stringify(cortex_data, null, 2));
 	var popupHtml = '<pre class="simplepre">' + cortex_data + '</pre>';
 	popupHtml += '<div class="close-icon useCursorPointer" onClick="closeScreenshot();"></div>';
 	$('#screenshot_box').html(popupHtml);
path: app/webroot/js/misp.js
Vulnerability: jpeg_size in pdfgen.c in PDFGen before 2018-04-09 has a heap-based buffer over-read.
Vulnerability ID: CVE-2018-11363
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/AndreRenaud/PDFGen
Published: 2018-05-22
File: pdfgen.c
Commit message: jpeg: Fix another possible buffer overrun

Found via the clang libfuzzer
Commit author: Andre Renaud

Vulnerable version (before fix):
 static int jpeg_size(unsigned char* data, unsigned int data_size,                     return 0;                 }                 i+=2;                 block_length = data[i] * 256 + data[i+1];             }         }     }

Fixed version (after fix):
 static int jpeg_size(unsigned char* data, unsigned int data_size,                     return 0;                 }                 i+=2;                 if (i + 1 < data_size)                     block_length = data[i] * 256 + data[i+1];             }         }     }

Patch:
patch: @@ -2036,7 +2036,8 @@ static int jpeg_size(unsigned char* data, unsigned int data_size,
                     return 0;
                 }
                 i+=2;
-                block_length = data[i] * 256 + data[i+1];
+                if (i + 1 < data_size)
+                    block_length = data[i] * 256 + data[i+1];
             }
         }
     }
path: pdfgen.c
Vulnerability: The _inst__lds() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.
Vulnerability ID: CVE-2018-11375
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/radare/radare2
Published: 2018-05-22
File: libr/anal/p/anal_avr.c
Commit message: Fix crash in anal.avr
Commit author: pancake

Vulnerable version (before fix):
 INST_HANDLER (ldi) {	// LDI Rd, K }  INST_HANDLER (lds) {	// LDS Rd, k 	int d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 0x1) << 4); 	int k = (buf[3] << 8) | buf[2]; 	op->ptr = k;

Fixed version (after fix):
 INST_HANDLER (ldi) {	// LDI Rd, K }  INST_HANDLER (lds) {	// LDS Rd, k 	if (len < 4) { 		return; 	} 	int d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 0x1) << 4); 	int k = (buf[3] << 8) | buf[2]; 	op->ptr = k;

Patch:
patch: @@ -912,6 +912,9 @@ INST_HANDLER (ldi) {	// LDI Rd, K
 }
 
 INST_HANDLER (lds) {	// LDS Rd, k
+	if (len < 4) {
+		return;
+	}
 	int d = ((buf[0] >> 4) & 0xf) | ((buf[1] & 0x1) << 4);
 	int k = (buf[3] << 8) | buf[2];
 	op->ptr = k;
path: libr/anal/p/anal_avr.c
Vulnerability: The wasm_dis() function in libr/asm/arch/wasm/wasm.c in or possibly have unspecified other impact via a crafted WASM file.
Vulnerability ID: CVE-2018-11378
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/radare/radare2
Published: 2018-05-22
File: libr/asm/arch/wasm/wasm.c
Commit message: Fix #9969 - Stack overflow in wasm disassembler
Commit author: pancake

Vulnerable version (before fix):
 int wasm_dis(WasmOp *op, const unsigned char *buf, int buf_len) { 			} 			op->len += n; 			snprintf (op->txt, R_ASM_BUFSIZE, "%s %d ", opdef->txt, count); 			for (i = 0; i < count && strlen (op->txt) + 10 < R_ASM_BUFSIZE; i++) { 				int optxtlen = strlen (op->txt); 				snprintf (op->txt + optxtlen, R_ASM_BUFSIZE - optxtlen, "%d ", table[i]); 			} 			snprintf (op->txt + strlen (op->txt), R_ASM_BUFSIZE, "%d", def); 			free (table); 			break; 			beach: 			free (table); 			goto err; 		}

Fixed version (after fix):
 int wasm_dis(WasmOp *op, const unsigned char *buf, int buf_len) { 			} 			op->len += n; 			snprintf (op->txt, R_ASM_BUFSIZE, "%s %d ", opdef->txt, count); 			char *txt = op->txt; 			int txtLen = strlen (op->txt); 			int txtLeft = R_ASM_BUFSIZE - txtLen; 			txt += txtLen; 			for (i = 0; i < count && txtLen + 10 < R_ASM_BUFSIZE; i++) { 				snprintf (txt, txtLeft, "%d ", table[i]); 				txtLen = strlen (txt); 				txt += txtLen; 				txtLeft -= txtLen; 			} 			snprintf (txt, txtLeft - 1, "%d", def); 			free (table); 			break; 		beach: 			free (table); 			goto err; 		}

Patch:
patch: @@ -414,14 +414,20 @@ int wasm_dis(WasmOp *op, const unsigned char *buf, int buf_len) {
 			}
 			op->len += n;
 			snprintf (op->txt, R_ASM_BUFSIZE, "%s %d ", opdef->txt, count);
-			for (i = 0; i < count && strlen (op->txt) + 10 < R_ASM_BUFSIZE; i++) {
-				int optxtlen = strlen (op->txt);
-				snprintf (op->txt + optxtlen, R_ASM_BUFSIZE - optxtlen, "%d ", table[i]);
+			char *txt = op->txt;
+			int txtLen = strlen (op->txt);
+			int txtLeft = R_ASM_BUFSIZE - txtLen;
+			txt += txtLen;
+			for (i = 0; i < count && txtLen + 10 < R_ASM_BUFSIZE; i++) {
+				snprintf (txt, txtLeft, "%d ", table[i]);
+				txtLen = strlen (txt);
+				txt += txtLen;
+				txtLeft -= txtLen;
 			}
-			snprintf (op->txt + strlen (op->txt), R_ASM_BUFSIZE, "%d", def);
+			snprintf (txt, txtLeft - 1, "%d", def);
 			free (table);
 			break;
-			beach:
+		beach:
 			free (table);
 			goto err;
 		}
path: libr/asm/arch/wasm/wasm.c
Vulnerability: The string_scan_range() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.
Vulnerability ID: CVE-2018-11381
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/radare/radare2
Published: 2018-05-22
File: libr/bin/file.c
Commit message: Fix #9902 - Fix oobread in RBin.string_scan_range
Commit author: pancake

Vulnerable version (before fix):
 static int string_scan_range(RList *list, RBinFile *bf, int min, 		eprintf ("Invalid range to find strings 0x%llx .. 0x%llx\n", from, to); 		return -1; 	} 	ut8 *buf = calloc (to - from, 1); 	if (!buf || !min) { 		return -1; 	} 	r_buf_read_at (bf->buf, from, buf, to - from); 	// may oobread 	while (needle < to) { 		rc = r_utf8_decode (buf + needle - from, to - needle, NULL); static int string_scan_range(RList *list, RBinFile *bf, int min, 		} 		if (type == R_STRING_TYPE_DETECT) { 			char *w = (char *)buf + needle + rc - from; 			if ((to - needle) > 5) { 				bool is_wide32 = needle + rc + 2 < to && !w[0] && !w[1] && !w[2] && w[3] && !w[4]; 				if (is_wide32) { 					str_type = R_STRING_TYPE_WIDE32; 				} else {

Fixed version (after fix):
 static int string_scan_range(RList *list, RBinFile *bf, int min, 		eprintf ("Invalid range to find strings 0x%llx .. 0x%llx\n", from, to); 		return -1; 	} 	int len = to - from; 	ut8 *buf = calloc (len, 1); 	if (!buf || !min) { 		return -1; 	} 	r_buf_read_at (bf->buf, from, buf, len); 	// may oobread 	while (needle < to) { 		rc = r_utf8_decode (buf + needle - from, to - needle, NULL); static int string_scan_range(RList *list, RBinFile *bf, int min, 		} 		if (type == R_STRING_TYPE_DETECT) { 			char *w = (char *)buf + needle + rc - from; 			if ((to - needle) > 5 + rc) { 				bool is_wide32 = (needle + rc + 2 < to) && (!w[0] && !w[1] && !w[2] && w[3] && !w[4]); 				if (is_wide32) { 					str_type = R_STRING_TYPE_WIDE32; 				} else {

Patch:
patch: @@ -76,11 +76,12 @@ static int string_scan_range(RList *list, RBinFile *bf, int min,
 		eprintf ("Invalid range to find strings 0x%llx .. 0x%llx\n", from, to);
 		return -1;
 	}
-	ut8 *buf = calloc (to - from, 1);
+	int len = to - from;
+	ut8 *buf = calloc (len, 1);
 	if (!buf || !min) {
 		return -1;
 	}
-	r_buf_read_at (bf->buf, from, buf, to - from);
+	r_buf_read_at (bf->buf, from, buf, len);
 	// may oobread
 	while (needle < to) {
 		rc = r_utf8_decode (buf + needle - from, to - needle, NULL);
@@ -90,8 +91,8 @@ static int string_scan_range(RList *list, RBinFile *bf, int min,
 		}
 		if (type == R_STRING_TYPE_DETECT) {
 			char *w = (char *)buf + needle + rc - from;
-			if ((to - needle) > 5) {
-				bool is_wide32 = needle + rc + 2 < to && !w[0] && !w[1] && !w[2] && w[3] && !w[4];
+			if ((to - needle) > 5 + rc) {
+				bool is_wide32 = (needle + rc + 2 < to) && (!w[0] && !w[1] && !w[2] && w[3] && !w[4]);
 				if (is_wide32) {
 					str_type = R_STRING_TYPE_WIDE32;
 				} else {
path: libr/bin/file.c
Vulnerability: The _inst__sts() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted binary file.
Vulnerability ID: CVE-2018-11382
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/radare/radare2
Published: 2018-05-22
File: libr/anal/p/anal_avr.c
Commit message: Fix #10091 - crash in AVR analysis
Commit author: pancake

Vulnerable version (before fix):
 INST_HANDLER (lds) {	// LDS Rd, k }  INST_HANDLER (sts) {	// STS k, Rr 	int r = ((buf[0] >> 4) & 0xf) | ((buf[1] & 0x1) << 4); 	int k = (buf[3] << 8) | buf[2]; 	op->ptr = k;

Fixed version (after fix):
 INST_HANDLER (lds) {	// LDS Rd, k }  INST_HANDLER (sts) {	// STS k, Rr 	if (len < 4) { 		return; 	} 	int r = ((buf[0] >> 4) & 0xf) | ((buf[1] & 0x1) << 4); 	int k = (buf[3] << 8) | buf[2]; 	op->ptr = k;

Patch:
patch: @@ -925,6 +925,9 @@ INST_HANDLER (lds) {	// LDS Rd, k
 }
 
 INST_HANDLER (sts) {	// STS k, Rr
+	if (len < 4) {
+		return;
+	}
 	int r = ((buf[0] >> 4) & 0xf) | ((buf[1] & 0x1) << 4);
 	int k = (buf[3] << 8) | buf[2];
 	op->ptr = k;
path: libr/anal/p/anal_avr.c
Vulnerability: The sh_op() function in radare2 2.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted ELF file.
Vulnerability ID: CVE-2018-11384
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/radare/radare2
Published: 2018-05-22
File: libr/anal/p/anal_sh.c
Commit message: Fix #9903 - oobread in RAnal.sh
Commit author: pancake

Vulnerable version (before fix):
 static int (*first_nibble_decode[])(RAnal*,RAnalOp*,ut16) = { static int sh_op(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *data, int len) { 	ut8 op_MSB,op_LSB; 	int ret; 	if (!data) 		return 0; 	memset (op, '\0', sizeof (RAnalOp)); 	op->addr = addr; 	op->type = R_ANAL_OP_TYPE_UNK;

Fixed version (after fix):
 static int (*first_nibble_decode[])(RAnal*,RAnalOp*,ut16) = { static int sh_op(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *data, int len) { 	ut8 op_MSB,op_LSB; 	int ret; 	if (!data || len < 2) { 		return 0; 	} 	memset (op, '\0', sizeof (RAnalOp)); 	op->addr = addr; 	op->type = R_ANAL_OP_TYPE_UNK;

Patch:
patch: @@ -763,8 +763,9 @@ static int (*first_nibble_decode[])(RAnal*,RAnalOp*,ut16) = {
 static int sh_op(RAnal *anal, RAnalOp *op, ut64 addr, const ut8 *data, int len) {
 	ut8 op_MSB,op_LSB;
 	int ret;
-	if (!data)
+	if (!data || len < 2) {
 		return 0;
+	}
 	memset (op, '\0', sizeof (RAnalOp));
 	op->addr = addr;
 	op->type = R_ANAL_OP_TYPE_UNK;
path: libr/anal/p/anal_sh.c
Vulnerability: The compat_get_timex function in kernel/compat.c in the Linux kernel before 4.16.9 allows local users to obtain sensitive information from kernel memory via adjtimex.
Vulnerability ID: CVE-2018-11508
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2018-05-28
File: kernel/compat.c
Commit message: compat: fix 4-byte infoleak via uninitialized struct field

Commit 3a4d44b61625 ("ntp: Move adjtimex related compat syscalls to
native counterparts") removed the memset() in compat_get_timex().  Since
then, the compat adjtimex syscall can invoke do_adjtimex() with an
uninitialized ->tai.

If do_adjtimex() doesn't write to ->tai (e.g.  because the arguments are
invalid), compat_put_timex() then copies the uninitialized ->tai field
to userspace.

Fix it by adding the memset() back.

Fixes: 3a4d44b61625 ("ntp: Move adjtimex related compat syscalls to native counterparts")
Signed-off-by: Jann Horn <jannh@google.com>
Acked-by: Kees Cook <keescook@chromium.org>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Jann Horn

Vulnerable version (before fix):
 int compat_get_timex(struct timex *txc, const struct compat_timex __user *utp) { 	struct compat_timex tx32;  	if (copy_from_user(&tx32, utp, sizeof(struct compat_timex))) 		return -EFAULT; 

Fixed version (after fix):
 int compat_get_timex(struct timex *txc, const struct compat_timex __user *utp) { 	struct compat_timex tx32;  	memset(txc, 0, sizeof(struct timex)); 	if (copy_from_user(&tx32, utp, sizeof(struct compat_timex))) 		return -EFAULT; 

Patch:
patch: @@ -34,6 +34,7 @@ int compat_get_timex(struct timex *txc, const struct compat_timex __user *utp)
 {
 	struct compat_timex tx32;
 
+	memset(txc, 0, sizeof(struct timex));
 	if (copy_from_user(&tx32, utp, sizeof(struct compat_timex)))
 		return -EFAULT;
path: kernel/compat.c