rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The decode_init function in libavcodec/utvideodec.c in FFmpeg 2.8 through 3.4.2 allows remote attackers to cause a denial of service (Out of array read) via an AVI file with crafted dimensions within chroma subsampling data.
Vulnerability ID: CVE-2018-7557
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/FFmpeg/FFmpeg
Published: 2018-02-28
File: libavcodec/utvideodec.c
Commit message: avcodec/utvideodec: Check subsample factors

Fixes: Out of array read
Fixes: heap_poc

Found-by: GwanYeong Kim <gy741.kim@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7414d0bda7763f9bd69c26c068e482ab297c1c96)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 #include <stdlib.h>  #include "libavutil/intreadwrite.h" #include "avcodec.h" #include "bswapdsp.h" #include "bytestream.h" static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, static av_cold int decode_init(AVCodecContext *avctx) {     UtvideoContext * const c = avctx->priv_data;      c->avctx = avctx;  static av_cold int decode_init(AVCodecContext *avctx)         return AVERROR_INVALIDDATA;     }      return 0; } 

Fixed version (after fix):
 #include <stdlib.h>  #include "libavutil/intreadwrite.h" #include "libavutil/pixdesc.h" #include "avcodec.h" #include "bswapdsp.h" #include "bytestream.h" static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, static av_cold int decode_init(AVCodecContext *avctx) {     UtvideoContext * const c = avctx->priv_data;     int h_shift, v_shift;      c->avctx = avctx;  static av_cold int decode_init(AVCodecContext *avctx)         return AVERROR_INVALIDDATA;     }      av_pix_fmt_get_chroma_sub_sample(avctx->pix_fmt, &h_shift, &v_shift);     if ((avctx->width  & ((1<<h_shift)-1)) ||         (avctx->height & ((1<<v_shift)-1))) {         avpriv_request_sample(avctx, "Odd dimensions");         return AVERROR_PATCHWELCOME;     }      return 0; } 

Patch:
patch: @@ -28,6 +28,7 @@
 #include <stdlib.h>
 
 #include "libavutil/intreadwrite.h"
+#include "libavutil/pixdesc.h"
 #include "avcodec.h"
 #include "bswapdsp.h"
 #include "bytestream.h"
@@ -474,6 +475,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
 static av_cold int decode_init(AVCodecContext *avctx)
 {
     UtvideoContext * const c = avctx->priv_data;
+    int h_shift, v_shift;
 
     c->avctx = avctx;
 
@@ -538,6 +540,13 @@ static av_cold int decode_init(AVCodecContext *avctx)
         return AVERROR_INVALIDDATA;
     }
 
+    av_pix_fmt_get_chroma_sub_sample(avctx->pix_fmt, &h_shift, &v_shift);
+    if ((avctx->width  & ((1<<h_shift)-1)) ||
+        (avctx->height & ((1<<v_shift)-1))) {
+        avpriv_request_sample(avctx, "Odd dimensions");
+        return AVERROR_PATCHWELCOME;
+    }
+
     return 0;
 }
path: libavcodec/utvideodec.c
Vulnerability: An issue was discovered in mj2/opj_mj2_extract.c in OpenJPEG 2.3.0. The output prefix was not checked for length, which could overflow a buffer, when providing a prefix with 50 or more characters on the command line.
Vulnerability ID: CVE-2018-7648
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/uclouvain/openjpeg
Published: 2018-03-02
File: src/bin/mj2/opj_mj2_extract.c
Commit message: opj_mj2_extract: Check provided output prefix for length

This uses snprintf() with correct buffer length instead of sprintf(), which
prevents a buffer overflow when providing a long output prefix. Furthermore
the program exits with an error when the provided output prefix is too long.

Fixes #1088.
Commit author: Karol Babioch

Vulnerable version (before fix):
 int main(int argc, char *argv[])         fread(frame_codestream, sample->sample_size - 8, 1,               file); /* Assuming that jp and ftyp markers size do*/          sprintf(outfilename, "%s_%05d.j2k", argv[2], snum);         outfile = fopen(outfilename, "wb");         if (!outfile) {             fprintf(stderr, "failed to open %s for writing\n", outfilename);             return 1;         }         fwrite(frame_codestream, sample->sample_size - 8, 1, outfile);

Fixed version (after fix):
 int main(int argc, char *argv[])         fread(frame_codestream, sample->sample_size - 8, 1,               file); /* Assuming that jp and ftyp markers size do*/          {             int num = snprintf(outfilename, sizeof(outfilename),                                "%s_%05d.j2k", argv[2],                                snum);             if (num >= sizeof(outfilename)) {                 fprintf(stderr, "maximum length of output prefix exceeded\n");                 free(frame_codestream);                 return 1;             }         }          outfile = fopen(outfilename, "wb");         if (!outfile) {             fprintf(stderr, "failed to open %s for writing\n", outfilename);             free(frame_codestream);             return 1;         }         fwrite(frame_codestream, sample->sample_size - 8, 1, outfile);

Patch:
patch: @@ -140,10 +140,21 @@ int main(int argc, char *argv[])
         fread(frame_codestream, sample->sample_size - 8, 1,
               file); /* Assuming that jp and ftyp markers size do*/
 
-        sprintf(outfilename, "%s_%05d.j2k", argv[2], snum);
+        {
+            int num = snprintf(outfilename, sizeof(outfilename),
+                               "%s_%05d.j2k", argv[2],
+                               snum);
+            if (num >= sizeof(outfilename)) {
+                fprintf(stderr, "maximum length of output prefix exceeded\n");
+                free(frame_codestream);
+                return 1;
+            }
+        }
+
         outfile = fopen(outfilename, "wb");
         if (!outfile) {
             fprintf(stderr, "failed to open %s for writing\n", outfilename);
+            free(frame_codestream);
             return 1;
         }
         fwrite(frame_codestream, sample->sample_size - 8, 1, outfile);
path: src/bin/mj2/opj_mj2_extract.c
Vulnerability: The unimac_mdio_probe function in drivers/net/phy/mdio-bcm-unimac.c in the Linux kernel through 4.15.8 does not validate certain resource availability, which allows local users to cause a denial of service (NULL pointer dereference).
Vulnerability ID: CVE-2018-8043
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2018-03-10
File: drivers/net/phy/mdio-bcm-unimac.c
Commit message: net: phy: mdio-bcm-unimac: fix potential NULL dereference in unimac_mdio_probe()

platform_get_resource() may fail and return NULL, so we should
better check it's return value to avoid a NULL pointer dereference
a bit later in the code.

This is detected by Coccinelle semantic patch.

@@
expression pdev, res, n, t, e, e1, e2;
@@

res = platform_get_resource(pdev, t, n);
+ if (!res)
+   return -EINVAL;
... when != res == NULL
e = devm_ioremap(e1, res->start, e2);

Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Wei Yongjun

Vulnerable version (before fix):
 static int unimac_mdio_probe(struct platform_device *pdev) 		return -ENOMEM;  	r = platform_get_resource(pdev, IORESOURCE_MEM, 0);  	/* Just ioremap, as this MDIO block is usually integrated into an 	 * Ethernet MAC controller register range

Fixed version (after fix):
 static int unimac_mdio_probe(struct platform_device *pdev) 		return -ENOMEM;  	r = platform_get_resource(pdev, IORESOURCE_MEM, 0); 	if (!r) 		return -EINVAL;  	/* Just ioremap, as this MDIO block is usually integrated into an 	 * Ethernet MAC controller register range

Patch:
patch: @@ -205,6 +205,8 @@ static int unimac_mdio_probe(struct platform_device *pdev)
 		return -ENOMEM;
 
 	r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	if (!r)
+		return -EINVAL;
 
 	/* Just ioremap, as this MDIO block is usually integrated into an
 	 * Ethernet MAC controller register range
path: drivers/net/phy/mdio-bcm-unimac.c
Vulnerability: The af_get_page() function in lib/afflib_pages.cpp in AFFLIB (aka AFFLIBv3) through 3.7.16 allows remote attackers to cause a denial of service (segmentation fault) via a corrupt AFF image that triggers an unexpected pagesize value.
Vulnerability ID: CVE-2018-8050
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/sshock/AFFLIBv3
Published: 2018-03-11
File: lib/afflib_pages.cpp
Commit message: Sanity check size passed to malloc...

Add sanity check before calling malloc in af_get_page() function to
avoid undefined behavior (e.g., seg fault) when dealing with a corrupt
AFF image with an invalid pagesize.

Issue found by Luis Rocha (luiscrocha@gmail.com).
Commit author: Phillip Hellewell

Vulnerable version (before fix):
 int af_get_page(AFFILE *af,int64_t pagenum,unsigned char *data,size_t *bytes) 	    return -3;			// read error 	}  	/* Now uncompress directly into the buffer provided by the caller, unless the caller didn't 	 * provide a buffer. If that happens, allocate our own... 	 */

Fixed version (after fix):
 int af_get_page(AFFILE *af,int64_t pagenum,unsigned char *data,size_t *bytes) 	    return -3;			// read error 	}  	/* Sanity check to avoid undefined behaviour when calling malloc below with pagesize from a corrupt AFF image. */ 	if(af->image_pagesize <= 0 || af->image_pagesize > 16*1024*1024) 	    return -1;   	/* Now uncompress directly into the buffer provided by the caller, unless the caller didn't 	 * provide a buffer. If that happens, allocate our own... 	 */

Patch:
patch: @@ -219,6 +219,11 @@ int af_get_page(AFFILE *af,int64_t pagenum,unsigned char *data,size_t *bytes)
 	    return -3;			// read error
 	}
 
+	/* Sanity check to avoid undefined behaviour when calling malloc below with pagesize from a corrupt AFF image. */
+	if(af->image_pagesize <= 0 || af->image_pagesize > 16*1024*1024)
+	    return -1;
+
+
 	/* Now uncompress directly into the buffer provided by the caller, unless the caller didn't
 	 * provide a buffer. If that happens, allocate our own...
 	 */
path: lib/afflib_pages.cpp
Vulnerability: FreeRDP prior to version 2.0.0-rc4 contains an Integer Truncation that leads to a Heap-Based Buffer Overflow in function update_read_bitmap_update() and results in a memory corruption and probably even a remote code execution.
Vulnerability ID: CVE-2018-8786
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/FreeRDP/FreeRDP
Published: 2018-11-29
File: libfreerdp/core/update.c
Commit message: Fixed CVE-2018-8786

Thanks to Eyal Itkin from Check Point Software Technologies.
Commit author: Armin Novak

Vulnerable version (before fix):
 BITMAP_UPDATE* update_read_bitmap_update(rdpUpdate* update, wStream* s)  	if (bitmapUpdate->number > bitmapUpdate->count) 	{ 		UINT16 count; 		BITMAP_DATA* newdata; 		count = bitmapUpdate->number * 2; 		newdata = (BITMAP_DATA*) realloc(bitmapUpdate->rectangles, 		                                 sizeof(BITMAP_DATA) * count);  		if (!newdata) 			goto fail;

Fixed version (after fix):
 BITMAP_UPDATE* update_read_bitmap_update(rdpUpdate* update, wStream* s)  	if (bitmapUpdate->number > bitmapUpdate->count) 	{ 		UINT32 count = bitmapUpdate->number * 2; 		BITMAP_DATA* newdata = (BITMAP_DATA*) realloc(bitmapUpdate->rectangles, 		                       sizeof(BITMAP_DATA) * count);  		if (!newdata) 			goto fail;

Patch:
patch: @@ -208,11 +208,9 @@ BITMAP_UPDATE* update_read_bitmap_update(rdpUpdate* update, wStream* s)
 
 	if (bitmapUpdate->number > bitmapUpdate->count)
 	{
-		UINT16 count;
-		BITMAP_DATA* newdata;
-		count = bitmapUpdate->number * 2;
-		newdata = (BITMAP_DATA*) realloc(bitmapUpdate->rectangles,
-		                                 sizeof(BITMAP_DATA) * count);
+		UINT32 count = bitmapUpdate->number * 2;
+		BITMAP_DATA* newdata = (BITMAP_DATA*) realloc(bitmapUpdate->rectangles,
+		                       sizeof(BITMAP_DATA) * count);
 
 		if (!newdata)
 			goto fail;
path: libfreerdp/core/update.c
Vulnerability: FreeRDP prior to version 2.0.0-rc4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in function gdi_Bitmap_Decompress() and results in a memory corruption and probably even a remote code execution.
Vulnerability ID: CVE-2018-8787
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/FreeRDP/FreeRDP
Published: 2018-11-29
File: libfreerdp/gdi/graphics.c
Commit message: Fixed CVE-2018-8787

Thanks to Eyal Itkin from Check Point Software Technologies.
Commit author: Armin Novak

Vulnerable version (before fix):
 static BOOL gdi_Bitmap_Decompress(rdpContext* context, rdpBitmap* bitmap, { 	UINT32 SrcSize = length; 	rdpGdi* gdi = context->gdi; 	bitmap->compressed = FALSE; 	bitmap->format = gdi->dstFormat; 	bitmap->length = DstWidth * DstHeight * GetBytesPerPixel(bitmap->format); 	bitmap->data = (BYTE*) _aligned_malloc(bitmap->length, 16);  	if (!bitmap->data)

Fixed version (after fix):
 static BOOL gdi_Bitmap_Decompress(rdpContext* context, rdpBitmap* bitmap, { 	UINT32 SrcSize = length; 	rdpGdi* gdi = context->gdi; 	UINT32 size = DstWidth * DstHeight; 	bitmap->compressed = FALSE; 	bitmap->format = gdi->dstFormat;  	if ((GetBytesPerPixel(bitmap->format) == 0) || 	    (DstWidth == 0) || (DstHeight == 0) || (DstWidth > UINT32_MAX / DstHeight) || 	    (size > (UINT32_MAX / GetBytesPerPixel(bitmap->format)))) 		return FALSE;  	size *= GetBytesPerPixel(bitmap->format); 	bitmap->length = size; 	bitmap->data = (BYTE*) _aligned_malloc(bitmap->length, 16);  	if (!bitmap->data)

Patch:
patch: @@ -141,9 +141,17 @@ static BOOL gdi_Bitmap_Decompress(rdpContext* context, rdpBitmap* bitmap,
 {
 	UINT32 SrcSize = length;
 	rdpGdi* gdi = context->gdi;
+	UINT32 size = DstWidth * DstHeight;
 	bitmap->compressed = FALSE;
 	bitmap->format = gdi->dstFormat;
-	bitmap->length = DstWidth * DstHeight * GetBytesPerPixel(bitmap->format);
+
+	if ((GetBytesPerPixel(bitmap->format) == 0) ||
+	    (DstWidth == 0) || (DstHeight == 0) || (DstWidth > UINT32_MAX / DstHeight) ||
+	    (size > (UINT32_MAX / GetBytesPerPixel(bitmap->format))))
+		return FALSE;
+
+	size *= GetBytesPerPixel(bitmap->format);
+	bitmap->length = size;
 	bitmap->data = (BYTE*) _aligned_malloc(bitmap->length, 16);
 
 	if (!bitmap->data)
path: libfreerdp/gdi/graphics.c
Vulnerability: FreeRDP prior to version 2.0.0-rc4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in function gdi_Bitmap_Decompress() and results in a memory corruption and probably even a remote code execution.
Vulnerability ID: CVE-2018-8787
CWE: CWE-190
Severity score: 6.4
Project: https://github.com/FreeRDP/FreeRDP
Published: 2018-11-29
File: libfreerdp/gdi/graphics.c
Commit message: Fixed CVE-2018-8787

Thanks to Eyal Itkin from Check Point Software Technologies.
Commit author: Armin Novak

Vulnerable version (before fix):
 static BOOL gdi_Bitmap_Decompress(rdpContext* context, rdpBitmap* bitmap, { 	UINT32 SrcSize = length; 	rdpGdi* gdi = context->gdi; 	bitmap->compressed = FALSE; 	bitmap->format = gdi->dstFormat; 	bitmap->length = DstWidth * DstHeight * GetBytesPerPixel(bitmap->format); 	bitmap->data = (BYTE*) _aligned_malloc(bitmap->length, 16);  	if (!bitmap->data)

Fixed version (after fix):
 static BOOL gdi_Bitmap_Decompress(rdpContext* context, rdpBitmap* bitmap, { 	UINT32 SrcSize = length; 	rdpGdi* gdi = context->gdi; 	UINT32 size = DstWidth * DstHeight; 	bitmap->compressed = FALSE; 	bitmap->format = gdi->dstFormat;  	if ((GetBytesPerPixel(bitmap->format) == 0) || 	    (DstWidth == 0) || (DstHeight == 0) || (DstWidth > UINT32_MAX / DstHeight) || 	    (size > (UINT32_MAX / GetBytesPerPixel(bitmap->format)))) 		return FALSE;  	size *= GetBytesPerPixel(bitmap->format); 	bitmap->length = size; 	bitmap->data = (BYTE*) _aligned_malloc(bitmap->length, 16);  	if (!bitmap->data)

Patch:
patch: @@ -141,9 +141,17 @@ static BOOL gdi_Bitmap_Decompress(rdpContext* context, rdpBitmap* bitmap,
 {
 	UINT32 SrcSize = length;
 	rdpGdi* gdi = context->gdi;
+	UINT32 size = DstWidth * DstHeight;
 	bitmap->compressed = FALSE;
 	bitmap->format = gdi->dstFormat;
-	bitmap->length = DstWidth * DstHeight * GetBytesPerPixel(bitmap->format);
+
+	if ((GetBytesPerPixel(bitmap->format) == 0) ||
+	    (DstWidth == 0) || (DstHeight == 0) || (DstWidth > UINT32_MAX / DstHeight) ||
+	    (size > (UINT32_MAX / GetBytesPerPixel(bitmap->format))))
+		return FALSE;
+
+	size *= GetBytesPerPixel(bitmap->format);
+	bitmap->length = size;
 	bitmap->data = (BYTE*) _aligned_malloc(bitmap->length, 16);
 
 	if (!bitmap->data)
path: libfreerdp/gdi/graphics.c
Vulnerability: A Buffer Overflow issue was discovered in Kamailio before 4.4.7, 5.0.x before 5.0.6, and 5.1.x before 5.1.2. A specially crafted REGISTER message with a malformed branch or From tag triggers an off-by-one heap-based buffer overflow in the tmx_check_pretran function in modules/tmx/tmx_pretran.c.
Vulnerability ID: CVE-2018-8828
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/kamailio/kamailio
Published: 2018-03-20
File: src/modules/tmx/tmx_pretran.c
Commit message: tmx: allocate space to store ending 0 for branch value

- reported by Alfred Farrugia and Sandro Gauci
Commit author: Daniel-Constantin Mierla

Vulnerable version (before fix):
 int tmx_check_pretran(sip_msg_t *msg) 	if(likely(vbr!=NULL)) { 		svbranch = vbr->value; 		trim(&svbranch); 		dsize += svbranch.len; 	} 	if(dsize<256) dsize = 256; 

Fixed version (after fix):
 int tmx_check_pretran(sip_msg_t *msg) 	if(likely(vbr!=NULL)) { 		svbranch = vbr->value; 		trim(&svbranch); 		dsize += svbranch.len + 1; 	} 	if(dsize<256) dsize = 256; 

Patch:
patch: @@ -260,7 +260,7 @@ int tmx_check_pretran(sip_msg_t *msg)
 	if(likely(vbr!=NULL)) {
 		svbranch = vbr->value;
 		trim(&svbranch);
-		dsize += svbranch.len;
+		dsize += svbranch.len + 1;
 	}
 	if(dsize<256) dsize = 256;
path: src/modules/tmx/tmx_pretran.c
Vulnerability: Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process.
Vulnerability ID: CVE-2018-9109
CWE: CWE-22
Severity score: 6.4
Project: https://github.com/Studio-42/elFinder
Published: 2018-03-28
File: php/elFinder.class.php
Commit message: [php:security] fix directory traversal vulnerability

Fixed vulnerability that can delete arbitrary files with zipdl command.

Fixed it because there was a possibility that files that can be deleted
may be deleted by the execution account of the web server.

Reviewed-by: Ravindra Rajaram <ravindra.rajaram@ca.com> and Kevin Kotas <kevin.kotas@ca.com>
Commit author: nao-pon

Vulnerable version (before fix):
 protected function zipdl($args) { 				return array('error' => 'File not found', 'header' => $h404, 'raw' => true); 			} 			$file = $targets[1]; 			$path = $volume->getTempPath().DIRECTORY_SEPARATOR.$file; 			// register auto delete on shutdown 			$GLOBALS['elFinderTempFiles'][$path] = true; 			if (!is_readable($path)) { 				return array('error' => 'File not found', 'header' => $h404, 'raw' => true); 			} 			$name = $targets[2];

Fixed version (after fix):
 protected function zipdl($args) { 				return array('error' => 'File not found', 'header' => $h404, 'raw' => true); 			} 			$file = $targets[1]; 			// checking the validity of the file parameter 			if (strpos($file, DIRECTORY_SEPARATOR) !== false) { 				return array('error' => 'File not found', 'header' => $h404, 'raw' => true); 			} 			$path = $volume->getTempPath().DIRECTORY_SEPARATOR.$file; 			// register auto delete on shutdown 			$GLOBALS['elFinderTempFiles'][$path] = true; 			if (!is_writable($path)) { 				return array('error' => 'File not found', 'header' => $h404, 'raw' => true); 			} 			$name = $targets[2];

Patch:
patch: @@ -1623,10 +1623,14 @@ protected function zipdl($args) {
 				return array('error' => 'File not found', 'header' => $h404, 'raw' => true);
 			}
 			$file = $targets[1];
+			// checking the validity of the file parameter
+			if (strpos($file, DIRECTORY_SEPARATOR) !== false) {
+				return array('error' => 'File not found', 'header' => $h404, 'raw' => true);
+			}
 			$path = $volume->getTempPath().DIRECTORY_SEPARATOR.$file;
 			// register auto delete on shutdown
 			$GLOBALS['elFinderTempFiles'][$path] = true;
-			if (!is_readable($path)) {
+			if (!is_writable($path)) {
 				return array('error' => 'File not found', 'header' => $h404, 'raw' => true);
 			}
 			$name = $targets[2];
path: php/elFinder.class.php
Vulnerability: Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process. NOTE: this issue exists because of an incomplete fix for CVE-2018-9109.
Vulnerability ID: CVE-2018-9110
CWE: CWE-22
Severity score: 6.4
Project: https://github.com/Studio-42/elFinder
Published: 2018-03-28
File: php/elFinder.class.php
Commit message: [php:security] re-fix directory traversal vulnerability for windows server

rel. commit 157f471d7e48f190f74e66eb5bc73360b5352fd3
Commit author: nao-pon

Vulnerable version (before fix):
 protected function zipdl($args) { 			} 			$file = $targets[1]; 			// checking the validity of the file parameter 			if (strpos($file, DIRECTORY_SEPARATOR) !== false) { 				return array('error' => 'File not found', 'header' => $h404, 'raw' => true); 			} 			$path = $volume->getTempPath().DIRECTORY_SEPARATOR.$file;

Fixed version (after fix):
 protected function zipdl($args) { 			} 			$file = $targets[1]; 			// checking the validity of the file parameter 			if (strpos(str_replace('/', DIRECTORY_SEPARATOR, $file), DIRECTORY_SEPARATOR) !== false) { 				return array('error' => 'File not found', 'header' => $h404, 'raw' => true); 			} 			$path = $volume->getTempPath().DIRECTORY_SEPARATOR.$file;

Patch:
patch: @@ -1624,7 +1624,7 @@ protected function zipdl($args) {
 			}
 			$file = $targets[1];
 			// checking the validity of the file parameter
-			if (strpos($file, DIRECTORY_SEPARATOR) !== false) {
+			if (strpos(str_replace('/', DIRECTORY_SEPARATOR, $file), DIRECTORY_SEPARATOR) !== false) {
 				return array('error' => 'File not found', 'header' => $h404, 'raw' => true);
 			}
 			$path = $volume->getTempPath().DIRECTORY_SEPARATOR.$file;
path: php/elFinder.class.php
Vulnerability: In check_user_token in util.c in the Yubico PAM module (aka pam_yubico) 2.18 through 2.25, successful logins can leak file descriptors to the auth mapping file, which can lead to information disclosure (serial number of a device) and/or DoS (reaching the maximum number of file descriptors).
Vulnerability ID: CVE-2018-9275
CWE: CWE-200
Severity score: 4.9
Project: https://github.com/Yubico/yubico-pam
Published: 2018-04-04
File: util.c
Commit message: util: make sure to close the authfile before returning success

fixes #136
Commit author: Klas Lindfors

Vulnerable version (before fix):
 check_user_token (const char *authfile, 		{ 		  if(verbose) 		      D (debug_file, "Match user/token as %s/%s", username, otp_id); 		  return AUTH_FOUND; 		} 	    }

Fixed version (after fix):
 check_user_token (const char *authfile, 		{ 		  if(verbose) 		      D (debug_file, "Match user/token as %s/%s", username, otp_id);  		  fclose(opwfile); 		  return AUTH_FOUND; 		} 	    }

Patch:
patch: @@ -167,6 +167,8 @@ check_user_token (const char *authfile,
 		{
 		  if(verbose)
 		      D (debug_file, "Match user/token as %s/%s", username, otp_id);
+
+		  fclose(opwfile);
 		  return AUTH_FOUND;
 		}
 	    }
path: util.c