rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: epan/crypt/airpdcap.c in the IEEE 802.11 dissector in Wireshark 2.x before 2.0.4 mishandles certain length values, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Vulnerability ID: CVE-2016-5352
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/wireshark/wireshark
Published: 2016-08-07
File: epan/crypt/airpdcap.c
Commit message: Sanity check eapol_len in AirPDcapDecryptWPABroadcastKey

Bug: 12175
Change-Id: Iaf977ba48f8668bf8095800a115ff9a3472dd893
Reviewed-on: https://code.wireshark.org/review/15326
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Tested-by: Peter Wu <peter@lekensteyn.nl>
Commit author: Michael Mann

Vulnerable version (before fix):
 AirPDcapDecryptWPABroadcastKey(const EAPOL_RSN_KEY *pEAPKey, guint8 *decryption_         }     }      if (key_bytes_len < GROUP_KEY_MIN_LEN || key_bytes_len > eapol_len - sizeof(EAPOL_RSN_KEY)) {         return AIRPDCAP_RET_NO_VALID_HANDSHAKE;     } 

Fixed version (after fix):
 AirPDcapDecryptWPABroadcastKey(const EAPOL_RSN_KEY *pEAPKey, guint8 *decryption_         }     }      if ((key_bytes_len < GROUP_KEY_MIN_LEN) ||         (eapol_len < sizeof(EAPOL_RSN_KEY)) ||         (key_bytes_len > eapol_len - sizeof(EAPOL_RSN_KEY))) {         return AIRPDCAP_RET_NO_VALID_HANDSHAKE;     } 

Patch:
patch: @@ -351,7 +351,9 @@ AirPDcapDecryptWPABroadcastKey(const EAPOL_RSN_KEY *pEAPKey, guint8 *decryption_
         }
     }
 
-    if (key_bytes_len < GROUP_KEY_MIN_LEN || key_bytes_len > eapol_len - sizeof(EAPOL_RSN_KEY)) {
+    if ((key_bytes_len < GROUP_KEY_MIN_LEN) ||
+        (eapol_len < sizeof(EAPOL_RSN_KEY)) ||
+        (key_bytes_len > eapol_len - sizeof(EAPOL_RSN_KEY))) {
         return AIRPDCAP_RET_NO_VALID_HANDSHAKE;
     }
path: epan/crypt/airpdcap.c
Vulnerability: Memory leak in the airspy_probe function in drivers/media/usb/airspy/airspy.c in the airspy USB driver in the Linux kernel before 4.7 allows local users to cause a denial of service (memory consumption) via a crafted USB device that emulates many VFL_TYPE_SDR or VFL_TYPE_SUBDEV devices and performs many connect and disconnect operations.
Vulnerability ID: CVE-2016-5400
CWE: CWE-119
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2016-08-06
File: drivers/media/usb/airspy/airspy.c
Commit message: media: fix airspy usb probe error path

Fix a memory leak on probe error of the airspy usb device driver.

The problem is triggered when more than 64 usb devices register with
v4l2 of type VFL_TYPE_SDR or VFL_TYPE_SUBDEV.

The memory leak is caused by the probe function of the airspy driver
mishandeling errors and not freeing the corresponding control structures
when an error occours registering the device to v4l2 core.

A badusb device can emulate 64 of these devices, and then through
continual emulated connect/disconnect of the 65th device, cause the
kernel to run out of RAM and crash the kernel, thus causing a local DOS
vulnerability.

Fixes CVE-2016-5400

Signed-off-by: James Patrick-Evans <james@jmp-e.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org # 3.17+
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: James Patrick-Evans

Vulnerable version (before fix):
 static int airspy_probe(struct usb_interface *intf, 	if (ret) { 		dev_err(s->dev, "Failed to register as video device (%d)\n", 				ret); 		goto err_unregister_v4l2_dev; 	} 	dev_info(s->dev, "Registered as %s\n", 			video_device_node_name(&s->vdev)); static int airspy_probe(struct usb_interface *intf,  err_free_controls: 	v4l2_ctrl_handler_free(&s->hdl); err_unregister_v4l2_dev: 	v4l2_device_unregister(&s->v4l2_dev); err_free_mem: 	kfree(s);

Fixed version (after fix):
 static int airspy_probe(struct usb_interface *intf, 	if (ret) { 		dev_err(s->dev, "Failed to register as video device (%d)\n", 				ret); 		goto err_free_controls; 	} 	dev_info(s->dev, "Registered as %s\n", 			video_device_node_name(&s->vdev)); static int airspy_probe(struct usb_interface *intf,  err_free_controls: 	v4l2_ctrl_handler_free(&s->hdl); 	v4l2_device_unregister(&s->v4l2_dev); err_free_mem: 	kfree(s);

Patch:
patch: @@ -1072,7 +1072,7 @@ static int airspy_probe(struct usb_interface *intf,
 	if (ret) {
 		dev_err(s->dev, "Failed to register as video device (%d)\n",
 				ret);
-		goto err_unregister_v4l2_dev;
+		goto err_free_controls;
 	}
 	dev_info(s->dev, "Registered as %s\n",
 			video_device_node_name(&s->vdev));
@@ -1081,7 +1081,6 @@ static int airspy_probe(struct usb_interface *intf,
 
 err_free_controls:
 	v4l2_ctrl_handler_free(&s->hdl);
-err_unregister_v4l2_dev:
 	v4l2_device_unregister(&s->v4l2_dev);
 err_free_mem:
 	kfree(s);
path: drivers/media/usb/airspy/airspy.c
Vulnerability: js/get_scripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to cause a denial of service via a large array in the scripts parameter.
Vulnerability ID: CVE-2016-5706
CWE: CWE-399
Severity score: 2.9
Project: https://github.com/phpmyadmin/phpmyadmin
Published: 2016-07-03
File: js/get_scripts.js.php
Commit message: Limit number of included scripts in get_scripts.js.php

This avoids potential DOS, the limit is same as we use for generating
the URLs.

Signed-off-by: Michal Čihař <michal@cihar.com>
Commit author: Michal Čihař

Vulnerable version (before fix):
 function () {  $_GET['scripts'] = json_decode($_GET['scripts']); if (! empty($_GET['scripts']) && is_array($_GET['scripts'])) {     foreach ($_GET['scripts'] as $script) {         // Sanitise filename         $script_name = 'js'; 

Fixed version (after fix):
 function () {  $_GET['scripts'] = json_decode($_GET['scripts']); if (! empty($_GET['scripts']) && is_array($_GET['scripts'])) {     // Only up to 10 scripts as this is what we generate     foreach (array_slice($_GET['scripts'], 0, 10) as $script) {         // Sanitise filename         $script_name = 'js'; 

Patch:
patch: @@ -36,7 +36,8 @@ function () {
 
 $_GET['scripts'] = json_decode($_GET['scripts']);
 if (! empty($_GET['scripts']) && is_array($_GET['scripts'])) {
-    foreach ($_GET['scripts'] as $script) {
+    // Only up to 10 scripts as this is what we generate
+    foreach (array_slice($_GET['scripts'], 0, 10) as $script) {
         // Sanitise filename
         $script_name = 'js';
path: js/get_scripts.js.php
Vulnerability: Race condition in the vop_ioctl function in drivers/misc/mic/vop/vop_vringh.c in the MIC VOP driver in the Linux kernel before 4.6.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (memory corruption and system crash) by changing a certain header, aka a "double fetch" vulnerability.
Vulnerability ID: CVE-2016-5728
CWE: CWE-119
Severity score: 7.8
Project: https://github.com/torvalds/linux
Published: 2016-06-27
File: drivers/misc/mic/vop/vop_vringh.c
Commit message: misc: mic: Fix for double fetch security bug in VOP driver

The MIC VOP driver does two successive reads from user space to read a
variable length data structure. Kernel memory corruption can result if
the data structure changes between the two reads. This patch disallows
the chance of this happening.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=116651
Reported by: Pengfei Wang <wpengfeinudt@gmail.com>
Reviewed-by: Sudeep Dutt <sudeep.dutt@intel.com>
Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Commit author: Ashutosh Dixit

Vulnerable version (before fix):
 static long vop_ioctl(struct file *f, unsigned int cmd, unsigned long arg) 			ret = -EFAULT; 			goto free_ret; 		} 		mutex_lock(&vdev->vdev_mutex); 		mutex_lock(&vi->vop_mutex); 		ret = vop_virtio_add_device(vdev, dd_config);

Fixed version (after fix):
 static long vop_ioctl(struct file *f, unsigned int cmd, unsigned long arg) 			ret = -EFAULT; 			goto free_ret; 		} 		/* Ensure desc has not changed between the two reads */ 		if (memcmp(&dd, dd_config, sizeof(dd))) { 			ret = -EINVAL; 			goto free_ret; 		} 		mutex_lock(&vdev->vdev_mutex); 		mutex_lock(&vi->vop_mutex); 		ret = vop_virtio_add_device(vdev, dd_config);

Patch:
patch: @@ -945,6 +945,11 @@ static long vop_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
 			ret = -EFAULT;
 			goto free_ret;
 		}
+		/* Ensure desc has not changed between the two reads */
+		if (memcmp(&dd, dd_config, sizeof(dd))) {
+			ret = -EINVAL;
+			goto free_ret;
+		}
 		mutex_lock(&vdev->vdev_mutex);
 		mutex_lock(&vi->vop_mutex);
 		ret = vop_virtio_add_device(vdev, dd_config);
path: drivers/misc/mic/vop/vop_vringh.c
Vulnerability: Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call.
Vulnerability ID: CVE-2016-5829
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2016-06-27
File: drivers/hid/usbhid/hiddev.c
Commit message: HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands

This patch validates the num_values parameter from userland during the
HIDIOCGUSAGES and HIDIOCSUSAGES commands. Previously, if the report id was set
to HID_REPORT_ID_UNKNOWN, we would fail to validate the num_values parameter
leading to a heap overflow.

Cc: stable@vger.kernel.org
Signed-off-by: Scott Bauer <sbauer@plzdonthack.me>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Commit author: Scott Bauer

Vulnerable version (before fix):
 static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd, 					goto inval; 			} else if (uref->usage_index >= field->report_count) 				goto inval;  			else if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) && 				 (uref_multi->num_values > HID_MAX_MULTI_USAGES || 				  uref->usage_index + uref_multi->num_values > field->report_count)) 				goto inval; 		}  		switch (cmd) { 		case HIDIOCGUSAGE: 			uref->value = field->value[uref->usage_index];

Fixed version (after fix):
 static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd, 					goto inval; 			} else if (uref->usage_index >= field->report_count) 				goto inval; 		}  		if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) && 		    (uref_multi->num_values > HID_MAX_MULTI_USAGES || 		     uref->usage_index + uref_multi->num_values > field->report_count)) 			goto inval;  		switch (cmd) { 		case HIDIOCGUSAGE: 			uref->value = field->value[uref->usage_index];

Patch:
patch: @@ -516,13 +516,13 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
 					goto inval;
 			} else if (uref->usage_index >= field->report_count)
 				goto inval;
-
-			else if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
-				 (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
-				  uref->usage_index + uref_multi->num_values > field->report_count))
-				goto inval;
 		}
 
+		if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
+		    (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
+		     uref->usage_index + uref_multi->num_values > field->report_count))
+			goto inval;
+
 		switch (cmd) {
 		case HIDIOCGUSAGE:
 			uref->value = field->value[uref->usage_index];
path: drivers/hid/usbhid/hiddev.c
Vulnerability: Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file.
Vulnerability ID: CVE-2016-5844
CWE: CWE-190
Severity score: 2.9
Project: https://github.com/libarchive/libarchive
Published: 2016-09-21
File: libarchive/archive_read_support_format_iso9660.c
Commit message: Issue 717:  Fix integer overflow when computing location of volume descriptor

The multiplication here defaulted to 'int' but calculations
of file positions should always use int64_t.  A simple cast
suffices to fix this since the base location is always 32 bits
for ISO, so multiplying by the sector size will never overflow
a 64-bit integer.
Commit author: Tim Kientzle

Vulnerable version (before fix):
 choose_volume(struct archive_read *a, struct iso9660 *iso9660) 		/* This condition is unlikely; by way of caution. */ 		vd = &(iso9660->joliet);  	skipsize = LOGICAL_BLOCK_SIZE * vd->location; 	skipsize = __archive_read_consume(a, skipsize); 	if (skipsize < 0) 		return ((int)skipsize); choose_volume(struct archive_read *a, struct iso9660 *iso9660) 	    && iso9660->seenJoliet) { 		/* Switch reading data from primary to joliet. */ 		vd = &(iso9660->joliet); 		skipsize = LOGICAL_BLOCK_SIZE * vd->location; 		skipsize -= iso9660->current_position; 		skipsize = __archive_read_consume(a, skipsize); 		if (skipsize < 0)

Fixed version (after fix):
 choose_volume(struct archive_read *a, struct iso9660 *iso9660) 		/* This condition is unlikely; by way of caution. */ 		vd = &(iso9660->joliet);  	skipsize = LOGICAL_BLOCK_SIZE * (int64_t)vd->location; 	skipsize = __archive_read_consume(a, skipsize); 	if (skipsize < 0) 		return ((int)skipsize); choose_volume(struct archive_read *a, struct iso9660 *iso9660) 	    && iso9660->seenJoliet) { 		/* Switch reading data from primary to joliet. */ 		vd = &(iso9660->joliet); 		skipsize = LOGICAL_BLOCK_SIZE * (int64_t)vd->location; 		skipsize -= iso9660->current_position; 		skipsize = __archive_read_consume(a, skipsize); 		if (skipsize < 0)

Patch:
patch: @@ -1091,7 +1091,7 @@ choose_volume(struct archive_read *a, struct iso9660 *iso9660)
 		/* This condition is unlikely; by way of caution. */
 		vd = &(iso9660->joliet);
 
-	skipsize = LOGICAL_BLOCK_SIZE * vd->location;
+	skipsize = LOGICAL_BLOCK_SIZE * (int64_t)vd->location;
 	skipsize = __archive_read_consume(a, skipsize);
 	if (skipsize < 0)
 		return ((int)skipsize);
@@ -1129,7 +1129,7 @@ choose_volume(struct archive_read *a, struct iso9660 *iso9660)
 	    && iso9660->seenJoliet) {
 		/* Switch reading data from primary to joliet. */
 		vd = &(iso9660->joliet);
-		skipsize = LOGICAL_BLOCK_SIZE * vd->location;
+		skipsize = LOGICAL_BLOCK_SIZE * (int64_t)vd->location;
 		skipsize -= iso9660->current_position;
 		skipsize = __archive_read_consume(a, skipsize);
 		if (skipsize < 0)
path: libarchive/archive_read_support_format_iso9660.c
Vulnerability: Race condition in the ec_device_ioctl_xcmd function in drivers/platform/chrome/cros_ec_dev.c in the Linux kernel before 4.7 allows local users to cause a denial of service (out-of-bounds array access) by changing a certain size value, aka a "double fetch" vulnerability.
Vulnerability ID: CVE-2016-6156
CWE: CWE-362
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2016-08-06
File: drivers/platform/chrome/cros_ec_dev.c
Commit message: platform/chrome: cros_ec_dev - double fetch bug in ioctl

We verify "u_cmd.outsize" and "u_cmd.insize" but we need to make sure
that those values have not changed between the two copy_from_user()
calls.  Otherwise it could lead to a buffer overflow.

Additionally, cros_ec_cmd_xfer() can set s_cmd->insize to a lower value.
We should use the new smaller value so we don't copy too much data to
the user.

Reported-by: Pengfei Wang <wpengfeinudt@gmail.com>
Fixes: a841178445bb ('mfd: cros_ec: Use a zero-length array for command data')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Tested-by: Gwendal Grignou <gwendal@chromium.org>
Cc: <stable@vger.kernel.org> # v4.2+
Signed-off-by: Olof Johansson <olof@lixom.net>
Commit author: Dan Carpenter

Vulnerable version (before fix):
 static long ec_device_ioctl_xcmd(struct cros_ec_dev *ec, void __user *arg) 		goto exit; 	}  	s_cmd->command += ec->cmd_offset; 	ret = cros_ec_cmd_xfer(ec->ec_dev, s_cmd); 	/* Only copy data to userland if data was received. */ 	if (ret < 0) 		goto exit;  	if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + u_cmd.insize)) 		ret = -EFAULT; exit: 	kfree(s_cmd);

Fixed version (after fix):
 static long ec_device_ioctl_xcmd(struct cros_ec_dev *ec, void __user *arg) 		goto exit; 	}  	if (u_cmd.outsize != s_cmd->outsize || 	    u_cmd.insize != s_cmd->insize) { 		ret = -EINVAL; 		goto exit; 	}  	s_cmd->command += ec->cmd_offset; 	ret = cros_ec_cmd_xfer(ec->ec_dev, s_cmd); 	/* Only copy data to userland if data was received. */ 	if (ret < 0) 		goto exit;  	if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + s_cmd->insize)) 		ret = -EFAULT; exit: 	kfree(s_cmd);

Patch:
patch: @@ -151,13 +151,19 @@ static long ec_device_ioctl_xcmd(struct cros_ec_dev *ec, void __user *arg)
 		goto exit;
 	}
 
+	if (u_cmd.outsize != s_cmd->outsize ||
+	    u_cmd.insize != s_cmd->insize) {
+		ret = -EINVAL;
+		goto exit;
+	}
+
 	s_cmd->command += ec->cmd_offset;
 	ret = cros_ec_cmd_xfer(ec->ec_dev, s_cmd);
 	/* Only copy data to userland if data was received. */
 	if (ret < 0)
 		goto exit;
 
-	if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + u_cmd.insize))
+	if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + s_cmd->insize))
 		ret = -EFAULT;
 exit:
 	kfree(s_cmd);
path: drivers/platform/chrome/cros_ec_dev.c
Vulnerability: Heap-based buffer overflow in the parse_packet function in network.c in collectd before 5.4.3 and 5.x before 5.5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted network packet.
Vulnerability ID: CVE-2016-6254
CWE: CWE-119
Severity score: 4.9
Project: https://github.com/collectd/collectd
Published: 2016-08-19
File: src/network.c
Commit message: network plugin: Fix heap overflow in parse_packet().

Emilien Gaspar has identified a heap overflow in parse_packet(), the
function used by the network plugin to parse incoming network packets.

This is a vulnerability in collectd, though the scope is not clear at
this point. At the very least specially crafted network packets can be
used to crash the daemon. We can't rule out a potential remote code
execution though.

Fixes: CVE-2016-6254
Commit author: Florian Forster

Vulnerable version (before fix):
 static int parse_packet (sockent_t *se, /* {{{ */ 				printed_ignore_warning = 1; 			} 			buffer = ((char *) buffer) + pkg_length; 			continue; 		} #endif /* HAVE_LIBGCRYPT */ static int parse_packet (sockent_t *se, /* {{{ */ 				printed_ignore_warning = 1; 			} 			buffer = ((char *) buffer) + pkg_length; 			continue; 		} #endif /* HAVE_LIBGCRYPT */ static int parse_packet (sockent_t *se, /* {{{ */ 			DEBUG ("network plugin: parse_packet: Unknown part" 					" type: 0x%04hx", pkg_type); 			buffer = ((char *) buffer) + pkg_length; 		} 	} /* while (buffer_size > sizeof (part_header_t)) */ 

Fixed version (after fix):
 static int parse_packet (sockent_t *se, /* {{{ */ 				printed_ignore_warning = 1; 			} 			buffer = ((char *) buffer) + pkg_length; 			buffer_size -= (size_t) pkg_length; 			continue; 		} #endif /* HAVE_LIBGCRYPT */ static int parse_packet (sockent_t *se, /* {{{ */ 				printed_ignore_warning = 1; 			} 			buffer = ((char *) buffer) + pkg_length; 			buffer_size -= (size_t) pkg_length; 			continue; 		} #endif /* HAVE_LIBGCRYPT */ static int parse_packet (sockent_t *se, /* {{{ */ 			DEBUG ("network plugin: parse_packet: Unknown part" 					" type: 0x%04hx", pkg_type); 			buffer = ((char *) buffer) + pkg_length; 			buffer_size -= (size_t) pkg_length; 		} 	} /* while (buffer_size > sizeof (part_header_t)) */ 

Patch:
patch: @@ -1435,6 +1435,7 @@ static int parse_packet (sockent_t *se, /* {{{ */
 				printed_ignore_warning = 1;
 			}
 			buffer = ((char *) buffer) + pkg_length;
+			buffer_size -= (size_t) pkg_length;
 			continue;
 		}
 #endif /* HAVE_LIBGCRYPT */
@@ -1462,6 +1463,7 @@ static int parse_packet (sockent_t *se, /* {{{ */
 				printed_ignore_warning = 1;
 			}
 			buffer = ((char *) buffer) + pkg_length;
+			buffer_size -= (size_t) pkg_length;
 			continue;
 		}
 #endif /* HAVE_LIBGCRYPT */
@@ -1603,6 +1605,7 @@ static int parse_packet (sockent_t *se, /* {{{ */
 			DEBUG ("network plugin: parse_packet: Unknown part"
 					" type: 0x%04hx", pkg_type);
 			buffer = ((char *) buffer) + pkg_length;
+			buffer_size -= (size_t) pkg_length;
 		}
 	} /* while (buffer_size > sizeof (part_header_t)) */
path: src/network.c
Vulnerability: Cross-site scripting (XSS) vulnerability in app/helpers/form_helper.rb in Foreman before 1.12.2, as used by Remote Execution and possibly other plugins, allows remote attackers to inject arbitrary web script or HTML via the label parameter.
Vulnerability ID: CVE-2016-6319
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/theforeman/foreman
Published: 2016-08-19
File: app/helpers/form_helper.rb
Commit message: Fixes #16024 - escape labels of form fields
Commit author: Marek Hulan

Vulnerable version (before fix):
 def add_label options, f, attr     label = options[:label] == :none ? '' : options.delete(:label)     label ||= ((clazz = f.object.class).respond_to?(:gettext_translation_for_attribute_name) &&         s_(clazz.gettext_translation_for_attribute_name attr)) if f     label = label.present? ? label_tag(attr, "#{label}#{required_mark}".html_safe, :class => label_size + " control-label") : ''     label   end 

Fixed version (after fix):
 def add_label options, f, attr     label = options[:label] == :none ? '' : options.delete(:label)     label ||= ((clazz = f.object.class).respond_to?(:gettext_translation_for_attribute_name) &&         s_(clazz.gettext_translation_for_attribute_name attr)) if f     label = label.present? ? label_tag(attr, "#{label}#{required_mark}", :class => label_size + " control-label") : ''     label   end 

Patch:
patch: @@ -283,7 +283,7 @@ def add_label options, f, attr
     label = options[:label] == :none ? '' : options.delete(:label)
     label ||= ((clazz = f.object.class).respond_to?(:gettext_translation_for_attribute_name) &&
         s_(clazz.gettext_translation_for_attribute_name attr)) if f
-    label = label.present? ? label_tag(attr, "#{label}#{required_mark}".html_safe, :class => label_size + " control-label") : ''
+    label = label.present? ? label_tag(attr, "#{label}#{required_mark}", :class => label_size + " control-label") : ''
     label
   end
path: app/helpers/form_helper.rb
Vulnerability: Buffer overflow in the Get8BIMProperty function in MagickCore/property.c in ImageMagick before 6.9.5-4 and 7.x before 7.0.2-6 allows remote attackers to cause a denial of service (out-of-bounds read, memory leak, and crash) via a crafted image.
Vulnerability ID: CVE-2016-6491
CWE: CWE-125
Severity score: 6.4
Project: https://github.com/ImageMagick/ImageMagick
Published: 2016-12-13
File: MagickCore/property.c
Commit message: Prevent buffer overflow (bug report from Ibrahim el-sayed)
Commit author: Cristy

Vulnerable version (before fix):
 static MagickBooleanType Get8BIMProperty(const Image *image,const char *key,     if ((count & 0x01) == 0)       (void) ReadPropertyByte(&info,&length);     count=(ssize_t) ReadPropertyMSBLong(&info,&length);     if ((*name != '\0') && (*name != '#'))       if ((resource == (char *) NULL) || (LocaleCompare(name,resource) != 0))         {

Fixed version (after fix):
 static MagickBooleanType Get8BIMProperty(const Image *image,const char *key,     if ((count & 0x01) == 0)       (void) ReadPropertyByte(&info,&length);     count=(ssize_t) ReadPropertyMSBLong(&info,&length);     if ((count < 0) || ((size_t) count > length))       {         length=0;          continue;       }     if ((*name != '\0') && (*name != '#'))       if ((resource == (char *) NULL) || (LocaleCompare(name,resource) != 0))         {

Patch:
patch: @@ -665,6 +665,11 @@ static MagickBooleanType Get8BIMProperty(const Image *image,const char *key,
     if ((count & 0x01) == 0)
       (void) ReadPropertyByte(&info,&length);
     count=(ssize_t) ReadPropertyMSBLong(&info,&length);
+    if ((count < 0) || ((size_t) count > length))
+      {
+        length=0; 
+        continue;
+      }
     if ((*name != '\0') && (*name != '#'))
       if ((resource == (char *) NULL) || (LocaleCompare(name,resource) != 0))
         {
path: MagickCore/property.c