rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The ip6_sk_dst_check function in net/ipv6/ip6_output.c in the Linux kernel before 3.10 allows local users to cause a denial of service (system crash) by using an AF_INET6 socket for a connection to an IPv4 interface.
Vulnerability ID: CVE-2013-2232
CWE: CWE-20
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-07-04
File: net/ipv6/ip6_output.c
Commit message: ipv6: ip6_sk_dst_check() must not assume ipv6 dst

It's possible to use AF_INET6 sockets and to connect to an IPv4
destination. After this, socket dst cache is a pointer to a rtable,
not rt6_info.

ip6_sk_dst_check() should check the socket dst cache is IPv6, or else
various corruptions/crashes can happen.

Dave Jones can reproduce immediate crash with
trinity -q -l off -n -c sendmsg -c connect

With help from Hannes Frederic Sowa

Reported-by: Dave Jones <davej@redhat.com>
Reported-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Eric Dumazet

Vulnerable version (before fix):
 static struct dst_entry *ip6_sk_dst_check(struct sock *sk, 					  const struct flowi6 *fl6) { 	struct ipv6_pinfo *np = inet6_sk(sk); 	struct rt6_info *rt = (struct rt6_info *)dst;  	if (!dst) 		goto out;  	/* Yes, checking route validity in not connected 	 * case is not very simple. Take into account, 	 * that we do not support routing by source, TOS,

Fixed version (after fix):
 static struct dst_entry *ip6_sk_dst_check(struct sock *sk, 					  const struct flowi6 *fl6) { 	struct ipv6_pinfo *np = inet6_sk(sk); 	struct rt6_info *rt;  	if (!dst) 		goto out;  	if (dst->ops->family != AF_INET6) { 		dst_release(dst); 		return NULL; 	}  	rt = (struct rt6_info *)dst; 	/* Yes, checking route validity in not connected 	 * case is not very simple. Take into account, 	 * that we do not support routing by source, TOS,

Patch:
patch: @@ -821,11 +821,17 @@ static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
 					  const struct flowi6 *fl6)
 {
 	struct ipv6_pinfo *np = inet6_sk(sk);
-	struct rt6_info *rt = (struct rt6_info *)dst;
+	struct rt6_info *rt;
 
 	if (!dst)
 		goto out;
 
+	if (dst->ops->family != AF_INET6) {
+		dst_release(dst);
+		return NULL;
+	}
+
+	rt = (struct rt6_info *)dst;
 	/* Yes, checking route validity in not connected
 	 * case is not very simple. Take into account,
 	 * that we do not support routing by source, TOS,
path: net/ipv6/ip6_output.c
Vulnerability: The (1) key_notify_sa_flush and (2) key_notify_policy_flush functions in net/key/af_key.c in the Linux kernel before 3.10 do not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify interface of an IPSec key_socket.
Vulnerability ID: CVE-2013-2234
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2013-07-04
File: net/key/af_key.c
Commit message: af_key: fix info leaks in notify messages

key_notify_sa_flush() and key_notify_policy_flush() miss to initialize
the sadb_msg_reserved member of the broadcasted message and thereby
leak 2 bytes of heap memory to listeners. Fix that.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 static int key_notify_sa_flush(const struct km_event *c) 	hdr->sadb_msg_version = PF_KEY_V2; 	hdr->sadb_msg_errno = (uint8_t) 0; 	hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));  	pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);  static int key_notify_policy_flush(const struct km_event *c) 	hdr->sadb_msg_errno = (uint8_t) 0; 	hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC; 	hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t)); 	pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net); 	return 0; 

Fixed version (after fix):
 static int key_notify_sa_flush(const struct km_event *c) 	hdr->sadb_msg_version = PF_KEY_V2; 	hdr->sadb_msg_errno = (uint8_t) 0; 	hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t)); 	hdr->sadb_msg_reserved = 0;  	pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);  static int key_notify_policy_flush(const struct km_event *c) 	hdr->sadb_msg_errno = (uint8_t) 0; 	hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC; 	hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t)); 	hdr->sadb_msg_reserved = 0; 	pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net); 	return 0; 

Patch:
patch: @@ -1710,6 +1710,7 @@ static int key_notify_sa_flush(const struct km_event *c)
 	hdr->sadb_msg_version = PF_KEY_V2;
 	hdr->sadb_msg_errno = (uint8_t) 0;
 	hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
+	hdr->sadb_msg_reserved = 0;
 
 	pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
 
@@ -2699,6 +2700,7 @@ static int key_notify_policy_flush(const struct km_event *c)
 	hdr->sadb_msg_errno = (uint8_t) 0;
 	hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
 	hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
+	hdr->sadb_msg_reserved = 0;
 	pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
 	return 0;
path: net/key/af_key.c
Vulnerability: The key_notify_policy_flush function in net/key/af_key.c in the Linux kernel before 3.9 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify_policy interface of an IPSec key_socket.
Vulnerability ID: CVE-2013-2237
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2013-07-04
File: net/key/af_key.c
Commit message: af_key: initialize satype in key_notify_policy_flush()

This field was left uninitialized. Some user daemons perform check against this
field.

Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Commit author: Nicolas Dichtel

Vulnerable version (before fix):
 static int key_notify_policy_flush(const struct km_event *c) 	hdr->sadb_msg_pid = c->portid; 	hdr->sadb_msg_version = PF_KEY_V2; 	hdr->sadb_msg_errno = (uint8_t) 0; 	hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t)); 	pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net); 	return 0;

Fixed version (after fix):
 static int key_notify_policy_flush(const struct km_event *c) 	hdr->sadb_msg_pid = c->portid; 	hdr->sadb_msg_version = PF_KEY_V2; 	hdr->sadb_msg_errno = (uint8_t) 0; 	hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC; 	hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t)); 	pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net); 	return 0;

Patch:
patch: @@ -2694,6 +2694,7 @@ static int key_notify_policy_flush(const struct km_event *c)
 	hdr->sadb_msg_pid = c->portid;
 	hdr->sadb_msg_version = PF_KEY_V2;
 	hdr->sadb_msg_errno = (uint8_t) 0;
+	hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
 	hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
 	pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
 	return 0;
path: net/key/af_key.c
Vulnerability: modules/gallery/helpers/data_rest.php in Gallery 3 before 3.0.9 allows remote attackers to bypass intended access restrictions and obtain sensitive information (image files) via the "full" string in the size parameter.
Vulnerability ID: CVE-2013-2241
CWE: CWE-264
Severity score: 2.9
Project: https://github.com/gallery/gallery3
Published: 2013-10-10
File: modules/gallery/helpers/data_rest.php
Commit message: #2074 - Mirror some additional file_proxy checks in data_rest.

--HG--
extra : source : 752417004a5c988b09f1312c4e96f10dd11594b9
Commit author: shadlaws

Vulnerable version (before fix):
 class data_rest_Core {   static function get($request) {     $item = rest::resolve($request->url);     access::required("view", $item);      $p = $request->params;     if (!isset($p->size) || !in_array($p->size, array("thumb", "resize", "full"))) { static function get($request) {     // see if you should make the same change there as well.      if ($p->size == "full") {       $file = $item->file_path();     } else if ($p->size == "resize") {       $file = $item->resize_path();     } else {       $file = $item->thumb_path();     } 

Fixed version (after fix):
 class data_rest_Core {   static function get($request) {     $item = rest::resolve($request->url);      $p = $request->params;     if (!isset($p->size) || !in_array($p->size, array("thumb", "resize", "full"))) { static function get($request) {     // see if you should make the same change there as well.      if ($p->size == "full") {       if ($item->is_album()) {         throw new Kohana_404_Exception();       }       access::required("view_full", $item);       $file = $item->file_path();     } else if ($p->size == "resize") {       access::required("view", $item);       $file = $item->resize_path();     } else {       access::required("view", $item);       $file = $item->thumb_path();     } 

Patch:
patch: @@ -25,7 +25,6 @@
 class data_rest_Core {
   static function get($request) {
     $item = rest::resolve($request->url);
-    access::required("view", $item);
 
     $p = $request->params;
     if (!isset($p->size) || !in_array($p->size, array("thumb", "resize", "full"))) {
@@ -36,10 +35,16 @@ static function get($request) {
     // see if you should make the same change there as well.
 
     if ($p->size == "full") {
+      if ($item->is_album()) {
+        throw new Kohana_404_Exception();
+      }
+      access::required("view_full", $item);
       $file = $item->file_path();
     } else if ($p->size == "resize") {
+      access::required("view", $item);
       $file = $item->resize_path();
     } else {
+      access::required("view", $item);
       $file = $item->thumb_path();
     }
path: modules/gallery/helpers/data_rest.php
Vulnerability: SQL injection vulnerability in Symphony CMS before 2.3.2 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter to system/authors/.  NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
Vulnerability ID: CVE-2013-2559
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/symphonycms/symphony-2
Published: 2014-03-27
File: symphony/lib/toolkit/class.authormanager.php
Commit message: Fix potential autheticated SQL injection attack on the Authors page
Commit author: Brendan Abbott

Vulnerable version (before fix):
 public static function delete($id) { 		 *  An array of Author objects. If no Authors are found, an empty array is returned. 		 */ 		public static function fetch($sortby = 'id', $sortdirection = 'ASC', $limit = null, $start = null, $where = null, $joins = null) {  			$records = Symphony::Database()->fetch(sprintf(" 					SELECT a.* public static function fetch($sortby = 'id', $sortdirection = 'ASC', $limit = nu 				", 				$joins, 				($where) ? $where : 1, 				'a.'.$sortby, $sortdirection, 				($limit) ? "LIMIT " . $limit : '', 				($start && $limit) ? ', ' . $start : '' 			));

Fixed version (after fix):
 public static function delete($id) { 		 *  An array of Author objects. If no Authors are found, an empty array is returned. 		 */ 		public static function fetch($sortby = 'id', $sortdirection = 'ASC', $limit = null, $start = null, $where = null, $joins = null) { 			$sortby = is_null($sortby) ? 'id' : Symphony::Database()->cleanValue($sortby); 			$sortdirection = $sortdirection === 'ASC' ? 'ASC' : 'DESC';  			$records = Symphony::Database()->fetch(sprintf(" 					SELECT a.* public static function fetch($sortby = 'id', $sortdirection = 'ASC', $limit = nu 				", 				$joins, 				($where) ? $where : 1, 				'a.'. $sortby, $sortdirection, 				($limit) ? "LIMIT " . $limit : '', 				($start && $limit) ? ', ' . $start : '' 			));

Patch:
patch: @@ -90,6 +90,8 @@ public static function delete($id) {
 		 *  An array of Author objects. If no Authors are found, an empty array is returned.
 		 */
 		public static function fetch($sortby = 'id', $sortdirection = 'ASC', $limit = null, $start = null, $where = null, $joins = null) {
+			$sortby = is_null($sortby) ? 'id' : Symphony::Database()->cleanValue($sortby);
+			$sortdirection = $sortdirection === 'ASC' ? 'ASC' : 'DESC';
 
 			$records = Symphony::Database()->fetch(sprintf("
 					SELECT a.*
@@ -101,7 +103,7 @@ public static function fetch($sortby = 'id', $sortdirection = 'ASC', $limit = nu
 				",
 				$joins,
 				($where) ? $where : 1,
-				'a.'.$sortby, $sortdirection,
+				'a.'. $sortby, $sortdirection,
 				($limit) ? "LIMIT " . $limit : '',
 				($start && $limit) ? ', ' . $start : ''
 			));
path: symphony/lib/toolkit/class.authormanager.php
Vulnerability: The rtnl_fill_ifinfo function in net/core/rtnetlink.c in the Linux kernel before 3.8.4 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
Vulnerability ID: CVE-2013-2635
CWE: CWE-399
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2013-03-22
File: net/core/rtnetlink.c
Commit message: rtnl: fix info leak on RTM_GETLINK request for VF devices

Initialize the mac address buffer with 0 as the driver specific function
will probably not fill the whole buffer. In fact, all in-kernel drivers
fill only ETH_ALEN of the MAX_ADDR_LEN bytes, i.e. 6 of the 32 possible
bytes. Therefore we currently leak 26 bytes of stack memory to userland
via the netlink interface.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev, 			 * report anything. 			 */ 			ivi.spoofchk = -1; 			if (dev->netdev_ops->ndo_get_vf_config(dev, i, &ivi)) 				break; 			vf_mac.vf =

Fixed version (after fix):
 static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev, 			 * report anything. 			 */ 			ivi.spoofchk = -1; 			memset(ivi.mac, 0, sizeof(ivi.mac)); 			if (dev->netdev_ops->ndo_get_vf_config(dev, i, &ivi)) 				break; 			vf_mac.vf =

Patch:
patch: @@ -979,6 +979,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
 			 * report anything.
 			 */
 			ivi.spoofchk = -1;
+			memset(ivi.mac, 0, sizeof(ivi.mac));
 			if (dev->netdev_ops->ndo_get_vf_config(dev, i, &ivi))
 				break;
 			vf_mac.vf =
path: net/core/rtnetlink.c
Vulnerability: security/MemberLoginForm.php in SilverStripe 3.0.3 supports login using a GET request, which makes it easier for remote attackers to conduct phishing attacks without detection by the victim.
Vulnerability ID: CVE-2013-2653
CWE: CWE-20
Severity score: 4.9
Project: https://github.com/chillu/silverstripe-framework
Published: 2013-11-13
File: security/MemberLoginForm.php
Commit message: API Restrict MemberLoginForm to POST requests for increased security

CVE-2013-2653 - Thanks to Fara Rustein of Deloitte Argentina for reporting.
Commit author: Ingo Schommer

Vulnerable version (before fix):
 public function __construct($controller, $name, $fields = null, $actions = null, 			$fields->push(new HiddenField('BackURL', 'BackURL', $backURL)); 		}  		parent::__construct($controller, $name, $fields, $actions);  		// Focus on the email input when the page is loaded

Fixed version (after fix):
 public function __construct($controller, $name, $fields = null, $actions = null, 			$fields->push(new HiddenField('BackURL', 'BackURL', $backURL)); 		}  		// Reduce attack surface by enforcing POST requests 		$this->setFormMethod('POST', true);  		parent::__construct($controller, $name, $fields, $actions);  		// Focus on the email input when the page is loaded

Patch:
patch: @@ -89,6 +89,9 @@ public function __construct($controller, $name, $fields = null, $actions = null,
 			$fields->push(new HiddenField('BackURL', 'BackURL', $backURL));
 		}
 
+		// Reduce attack surface by enforcing POST requests
+		$this->setFormMethod('POST', true);
+
 		parent::__construct($controller, $name, $fields, $actions);
 
 		// Focus on the email input when the page is loaded
path: security/MemberLoginForm.php
Vulnerability: The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.
Vulnerability ID: CVE-2013-2765
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/SpiderLabs/ModSecurity
Published: 2013-07-15
File: apache2/msc_reqbody.c
Commit message: Fixed: chuck null pointer when unknown CT is sent and over in-memory limit
Commit author: Breno Silva

Vulnerable version (before fix):
 static apr_status_t modsecurity_request_body_store_memory(modsec_rec *msr,      /* Would storing this chunk mean going over the limit? */     if ((msr->msc_reqbody_spilltodisk)         && (msr->msc_reqbody_length + length > (apr_size_t)msr->txcfg->reqbody_inmemory_limit))     {         msc_data_chunk **chunks;

Fixed version (after fix):
 static apr_status_t modsecurity_request_body_store_memory(modsec_rec *msr,      /* Would storing this chunk mean going over the limit? */     if ((msr->msc_reqbody_spilltodisk)         && (msr->txcfg->reqbody_buffering != REQUEST_BODY_FORCEBUF_ON)         && (msr->msc_reqbody_length + length > (apr_size_t)msr->txcfg->reqbody_inmemory_limit))     {         msc_data_chunk **chunks;

Patch:
patch: @@ -170,6 +170,7 @@ static apr_status_t modsecurity_request_body_store_memory(modsec_rec *msr,
 
     /* Would storing this chunk mean going over the limit? */
     if ((msr->msc_reqbody_spilltodisk)
+        && (msr->txcfg->reqbody_buffering != REQUEST_BODY_FORCEBUF_ON)
         && (msr->msc_reqbody_length + length > (apr_size_t)msr->txcfg->reqbody_inmemory_limit))
     {
         msc_data_chunk **chunks;
path: apache2/msc_reqbody.c
Vulnerability: The perf_trace_event_perm function in kernel/trace/trace_event_perf.c in the Linux kernel before 3.12.2 does not properly restrict access to the perf subsystem, which allows local users to enable function tracing via a crafted application.
Vulnerability ID: CVE-2013-2930
CWE: CWE-264
Severity score: 4.9
Project: https://github.com/torvalds/linux
Published: 2013-12-09
File: kernel/trace/trace_event_perf.c
Commit message: perf/ftrace: Fix paranoid level for enabling function tracer

The current default perf paranoid level is "1" which has
"perf_paranoid_kernel()" return false, and giving any operations that
use it, access to normal users. Unfortunately, this includes function
tracing and normal users should not be allowed to enable function
tracing by default.

The proper level is defined at "-1" (full perf access), which
"perf_paranoid_tracepoint_raw()" will only give access to. Use that
check instead for enabling function tracing.

Reported-by: Dave Jones <davej@redhat.com>
Reported-by: Vince Weaver <vincent.weaver@maine.edu>
Tested-by: Vince Weaver <vincent.weaver@maine.edu>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: stable@vger.kernel.org # 3.4+
CVE: CVE-2013-2930
Fixes: ced39002f5ea ("ftrace, perf: Add support to use function tracepoint in perf")
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Commit author: Steven Rostedt

Vulnerable version (before fix):
 static int perf_trace_event_perm(struct ftrace_event_call *tp_event, { 	/* The ftrace function trace is allowed only for root. */ 	if (ftrace_event_is_function(tp_event) && 	    perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN)) 		return -EPERM;  	/* No tracing, just counting, so no obvious leak */

Fixed version (after fix):
 static int perf_trace_event_perm(struct ftrace_event_call *tp_event, { 	/* The ftrace function trace is allowed only for root. */ 	if (ftrace_event_is_function(tp_event) && 	    perf_paranoid_tracepoint_raw() && !capable(CAP_SYS_ADMIN)) 		return -EPERM;  	/* No tracing, just counting, so no obvious leak */

Patch:
patch: @@ -26,7 +26,7 @@ static int perf_trace_event_perm(struct ftrace_event_call *tp_event,
 {
 	/* The ftrace function trace is allowed only for root. */
 	if (ftrace_event_is_function(tp_event) &&
-	    perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN))
+	    perf_paranoid_tracepoint_raw() && !capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
 	/* No tracing, just counting, so no obvious leak */
path: kernel/trace/trace_event_perf.c
Vulnerability: SQL injection vulnerability in the checkEmailFormat function in plugins/jojo_core/classes/Jojo.php in Jojo before 1.2.2 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header to /articles/test/.
Vulnerability ID: CVE-2013-3081
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/JojoCMS/Jojo-CMS
Published: 2014-06-09
File: plugins/jojo_core/classes/Jojo.php
Commit message: Fix SQL injection issue CVE-2013-3081
Commit author: Harvey Kane

Vulnerable version (before fix):
 static function checkEmailFormat($email)     /* Gets the IP address of the visitor, bypassing proxies */     static function getIp()     {         if ( (getenv('HTTP_X_FORWARDED_FOR') != '') && (strtolower(getenv('HTTP_X_FORWARDED_FOR')) != 'unknown')) {             $iparray = explode(',', getenv('HTTP_X_FORWARDED_FOR'));             return $iparray[0];         } elseif (getenv('REMOTE_ADDR') != '') {             return getenv('REMOTE_ADDR');         } else {             return false;         }     }      /* reads the user agent string and gives the browser type - quick and simple detection */

Fixed version (after fix):
 static function checkEmailFormat($email)     /* Gets the IP address of the visitor, bypassing proxies */     static function getIp()     {         $ip = false;         if ( (getenv('HTTP_X_FORWARDED_FOR') != '') && (strtolower(getenv('HTTP_X_FORWARDED_FOR')) != 'unknown')) {             $iparray = explode(',', getenv('HTTP_X_FORWARDED_FOR'));             $ip = $iparray[0];         } elseif (getenv('REMOTE_ADDR') != '') {             $ip = getenv('REMOTE_ADDR');         }         /* check IP is valid format */         if (preg_match('/\\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\b/', $ip)) {         	return $ip;         }         return false;     }      /* reads the user agent string and gives the browser type - quick and simple detection */

Patch:
patch: @@ -2461,14 +2461,18 @@ static function checkEmailFormat($email)
     /* Gets the IP address of the visitor, bypassing proxies */
     static function getIp()
     {
+        $ip = false;
         if ( (getenv('HTTP_X_FORWARDED_FOR') != '') && (strtolower(getenv('HTTP_X_FORWARDED_FOR')) != 'unknown')) {
             $iparray = explode(',', getenv('HTTP_X_FORWARDED_FOR'));
-            return $iparray[0];
+            $ip = $iparray[0];
         } elseif (getenv('REMOTE_ADDR') != '') {
-            return getenv('REMOTE_ADDR');
-        } else {
-            return false;
+            $ip = getenv('REMOTE_ADDR');
         }
+        /* check IP is valid format */
+        if (preg_match('/\\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\b/', $ip)) {
+        	return $ip;
+        }
+        return false;
     }
 
     /* reads the user agent string and gives the browser type - quick and simple detection */
path: plugins/jojo_core/classes/Jojo.php