rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.
Vulnerability ID: CVE-2017-16645
CWE: CWE-125
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-11-07
File: drivers/input/misc/ims-pcu.c
Commit message: Input: ims-psu - check if CDC union descriptor is sane

Before trying to use CDC union descriptor, try to validate whether that it
is sane by checking that intf->altsetting->extra is big enough and that
descriptor bLength is not too big and not too small.

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Commit author: Dmitry Torokhov

Vulnerable version (before fix):
 ims_pcu_get_cdc_union_desc(struct usb_interface *intf) 		return NULL; 	}  	while (buflen > 0) { 		union_desc = (struct usb_cdc_union_desc *)buf;  		if (union_desc->bDescriptorType == USB_DT_CS_INTERFACE && 		    union_desc->bDescriptorSubType == USB_CDC_UNION_TYPE) { 			dev_dbg(&intf->dev, "Found union header\n"); 			return union_desc; 		}  		buflen -= union_desc->bLength;

Fixed version (after fix):
 ims_pcu_get_cdc_union_desc(struct usb_interface *intf) 		return NULL; 	}  	while (buflen >= sizeof(*union_desc)) { 		union_desc = (struct usb_cdc_union_desc *)buf;  		if (union_desc->bLength > buflen) { 			dev_err(&intf->dev, "Too large descriptor\n"); 			return NULL; 		}  		if (union_desc->bDescriptorType == USB_DT_CS_INTERFACE && 		    union_desc->bDescriptorSubType == USB_CDC_UNION_TYPE) { 			dev_dbg(&intf->dev, "Found union header\n");  			if (union_desc->bLength >= sizeof(*union_desc)) 				return union_desc;  			dev_err(&intf->dev, 				"Union descriptor to short (%d vs %zd\n)", 				union_desc->bLength, sizeof(*union_desc)); 			return NULL; 		}  		buflen -= union_desc->bLength;

Patch:
patch: @@ -1635,13 +1635,25 @@ ims_pcu_get_cdc_union_desc(struct usb_interface *intf)
 		return NULL;
 	}
 
-	while (buflen > 0) {
+	while (buflen >= sizeof(*union_desc)) {
 		union_desc = (struct usb_cdc_union_desc *)buf;
 
+		if (union_desc->bLength > buflen) {
+			dev_err(&intf->dev, "Too large descriptor\n");
+			return NULL;
+		}
+
 		if (union_desc->bDescriptorType == USB_DT_CS_INTERFACE &&
 		    union_desc->bDescriptorSubType == USB_CDC_UNION_TYPE) {
 			dev_dbg(&intf->dev, "Found union header\n");
-			return union_desc;
+
+			if (union_desc->bLength >= sizeof(*union_desc))
+				return union_desc;
+
+			dev_err(&intf->dev,
+				"Union descriptor to short (%d vs %zd\n)",
+				union_desc->bLength, sizeof(*union_desc));
+			return NULL;
 		}
 
 		buflen -= union_desc->bLength;
path: drivers/input/misc/ims-pcu.c
Vulnerability: In Libav through 11.11 and 12.x through 12.1, the smacker_decode_tree function in libavcodec/smacker.c does not properly restrict tree recursion, which allows remote attackers to cause a denial of service (bitstream.c:build_table() out-of-bounds read and application crash) via a crafted Smacker stream.
Vulnerability ID: CVE-2017-16803
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/libav/libav
Published: 2017-11-13
File: libavcodec/smacker.c
Commit message: smacker: add sanity check for length in smacker_decode_tree()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Bug-Id: 1098
Cc: libav-stable@libav.org
Signed-off-by: Sean McGovern <gseanmcg@gmail.com>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
  #define SMKTREE_BITS 9 #define SMK_NODE 0x80000000   typedef struct SmackVContext {     AVCodecContext *avctx; enum SmkBlockTypes { static int smacker_decode_tree(BitstreamContext *bc, HuffContext *hc,                                uint32_t prefix, int length) {     if (!bitstream_read_bit(bc)) { // Leaf         if(hc->current >= 256){             av_log(NULL, AV_LOG_ERROR, "Tree size exceeded!\n");

Fixed version (after fix):
  #define SMKTREE_BITS 9 #define SMK_NODE 0x80000000 #define SMKTREE_DECODE_MAX_RECURSION 32  typedef struct SmackVContext {     AVCodecContext *avctx; enum SmkBlockTypes { static int smacker_decode_tree(BitstreamContext *bc, HuffContext *hc,                                uint32_t prefix, int length) {     if (length > SMKTREE_DECODE_MAX_RECURSION) {         av_log(NULL, AV_LOG_ERROR, "Maximum tree recursion level exceeded.\n");         return AVERROR_INVALIDDATA;     }      if (!bitstream_read_bit(bc)) { // Leaf         if(hc->current >= 256){             av_log(NULL, AV_LOG_ERROR, "Tree size exceeded!\n");

Patch:
patch: @@ -43,7 +43,7 @@
 
 #define SMKTREE_BITS 9
 #define SMK_NODE 0x80000000
-
+#define SMKTREE_DECODE_MAX_RECURSION 32
 
 typedef struct SmackVContext {
     AVCodecContext *avctx;
@@ -97,6 +97,11 @@ enum SmkBlockTypes {
 static int smacker_decode_tree(BitstreamContext *bc, HuffContext *hc,
                                uint32_t prefix, int length)
 {
+    if (length > SMKTREE_DECODE_MAX_RECURSION) {
+        av_log(NULL, AV_LOG_ERROR, "Maximum tree recursion level exceeded.\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     if (!bitstream_read_bit(bc)) { // Leaf
         if(hc->current >= 256){
             av_log(NULL, AV_LOG_ERROR, "Tree size exceeded!\n");
path: libavcodec/smacker.c
Vulnerability: The dump function in Util/TemplateHelper.php in filp whoops before 2.1.13 has XSS.
Vulnerability ID: CVE-2017-16880
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/filp/whoops
Published: 2017-11-17
File: src/Whoops/Util/TemplateHelper.php
Commit message: TemplateHelper: fix XSS if Symfony dumper is not available
Commit author: Denis Sokolov

Vulnerable version (before fix):
 public function dump($value)             return $output;         }          return print_r($value, true);     }      /**

Fixed version (after fix):
 public function dump($value)             return $output;         }          return htmlspecialchars(print_r($value, true));     }      /**

Patch:
patch: @@ -183,7 +183,7 @@ public function dump($value)
             return $output;
         }
 
-        return print_r($value, true);
+        return htmlspecialchars(print_r($value, true));
     }
 
     /**
path: src/Whoops/Util/TemplateHelper.php
Vulnerability: In Horde Groupware 5.2.19-5.2.22, there is XSS via the URL field in a "Calendar -> New Event" action.
Vulnerability ID: CVE-2017-16906
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/horde/kronolith
Published: 2017-11-20
File: lib/Event.php
Commit message: Bug: 14857

Prevent XSS in event's URL field.
Commit author: Michael J Rubinsky

Vulnerable version (before fix):
 public function toJson($allDay = null, $full = false, $time_format = 'H:i')             }             if (!$this->isPrivate()) {                 $json->d = $this->description;                 $json->u = $this->url;                 $json->uhl = $GLOBALS['injector']->getInstance('Horde_Core_Factory_TextFilter')->filter($this->url, 'linkurls');                 $json->tg = array_values($this->tags);                 $json->gl = $this->geoLocation;                 if ($this->attendees) {

Fixed version (after fix):
 public function toJson($allDay = null, $full = false, $time_format = 'H:i')             }             if (!$this->isPrivate()) {                 $json->d = $this->description;                 $json->u =  htmlentities($this->url);                 $json->uhl = htmlentities($GLOBALS['injector']->getInstance('Horde_Core_Factory_TextFilter')->filter($this->url, 'linkurls'));                 $json->tg = array_values($this->tags);                 $json->gl = $this->geoLocation;                 if ($this->attendees) {

Patch:
patch: @@ -2402,8 +2402,8 @@ public function toJson($allDay = null, $full = false, $time_format = 'H:i')
             }
             if (!$this->isPrivate()) {
                 $json->d = $this->description;
-                $json->u = $this->url;
-                $json->uhl = $GLOBALS['injector']->getInstance('Horde_Core_Factory_TextFilter')->filter($this->url, 'linkurls');
+                $json->u =  htmlentities($this->url);
+                $json->uhl = htmlentities($GLOBALS['injector']->getInstance('Horde_Core_Factory_TextFilter')->filter($this->url, 'linkurls'));
                 $json->tg = array_values($this->tags);
                 $json->gl = $this->geoLocation;
                 if ($this->attendees) {
path: lib/Event.php
Vulnerability: In Horde Groupware 5.2.19 and 5.2.21, there is XSS via the Color field in a Create Task List action.
Vulnerability ID: CVE-2017-16907
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/horde/base
Published: 2017-11-20
File: lib/View/Sidebar.php
Commit message: Bug: 14857

Escape user supplied color data, preventing XSS vuln.
Commit author: Michael J Rubinsky

Vulnerable version (before fix):
 public function addRow(array $row, $container = '')             if (strlen($row['style'])) {                 $row['style'] .= ';';             }             $row['style'] .= 'background-color:' . $row['color']                 . ';color:#' . $foreground;             if (isset($row['edit'])) {                 $row['editLink'] = $row['edit']

Fixed version (after fix):
 public function addRow(array $row, $container = '')             if (strlen($row['style'])) {                 $row['style'] .= ';';             }             $row['style'] .= 'background-color:' . htmlspecialchars($row['color'])                 . ';color:#' . $foreground;             if (isset($row['edit'])) {                 $row['editLink'] = $row['edit']

Patch:
patch: @@ -221,7 +221,7 @@ public function addRow(array $row, $container = '')
             if (strlen($row['style'])) {
                 $row['style'] .= ';';
             }
-            $row['style'] .= 'background-color:' . $row['color']
+            $row['style'] .= 'background-color:' . htmlspecialchars($row['color'])
                 . ';color:#' . $foreground;
             if (isset($row['edit'])) {
                 $row['editLink'] = $row['edit']
path: lib/View/Sidebar.php
Vulnerability: In Horde Groupware 5.2.19, there is XSS via the Name field during creation of a new Resource. This can be leveraged for remote code execution after compromising an administrator account, because the CVE-2015-7984 CSRF protection mechanism can then be bypassed.
Vulnerability ID: CVE-2017-16908
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/horde/kronolith
Published: 2017-11-20
File: js/kronolith.js
Commit message: Bug: 14857

Escape user-provided resource name when outputting. Prevents XSS vuln.
Commit author: Michael J Rubinsky

Vulnerable version (before fix):
 KronolithCore = {         }         $('kronolithCalendarresourcegroupmembers').update();         $H(Kronolith.conf.calendars.resource).each(function(r) {             var o = new Element('option', { value: r.value.id }).update(r.value.name);             $('kronolithCalendarresourcegroupmembers').insert(o);         });     },

Fixed version (after fix):
 KronolithCore = {         }         $('kronolithCalendarresourcegroupmembers').update();         $H(Kronolith.conf.calendars.resource).each(function(r) {             var o = new Element('option', { value: r.value.id }).update(r.value.name.escapeHTML());             $('kronolithCalendarresourcegroupmembers').insert(o);         });     },

Patch:
patch: @@ -3322,7 +3322,7 @@ KronolithCore = {
         }
         $('kronolithCalendarresourcegroupmembers').update();
         $H(Kronolith.conf.calendars.resource).each(function(r) {
-            var o = new Element('option', { value: r.value.id }).update(r.value.name);
+            var o = new Element('option', { value: r.value.id }).update(r.value.name.escapeHTML());
             $('kronolithCalendarresourcegroupmembers').insert(o);
         });
     },
path: js/kronolith.js
Vulnerability: The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call.
Vulnerability ID: CVE-2017-16994
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2017-11-27
File: mm/pagewalk.c
Commit message: mm/pagewalk.c: report holes in hugetlb ranges

This matters at least for the mincore syscall, which will otherwise copy
uninitialized memory from the page allocator to userspace.  It is
probably also a correctness error for /proc/$pid/pagemap, but I haven't
tested that.

Removing the `walk->hugetlb_entry` condition in walk_hugetlb_range() has
no effect because the caller already checks for that.

This only reports holes in hugetlb ranges to callers who have specified
a hugetlb_entry callback.

This issue was found using an AFL-based fuzzer.

v2:
 - don't crash on ->pte_hole==NULL (Andrew Morton)
 - add Cc stable (Andrew Morton)

Fixes: 1e25a271c8ac ("mincore: apply page table walker on do_mincore()")
Signed-off-by: Jann Horn <jannh@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Jann Horn

Vulnerable version (before fix):
 static int walk_hugetlb_range(unsigned long addr, unsigned long end, 	do { 		next = hugetlb_entry_end(h, addr, end); 		pte = huge_pte_offset(walk->mm, addr & hmask, sz); 		if (pte && walk->hugetlb_entry) 			err = walk->hugetlb_entry(pte, hmask, addr, next, walk); 		if (err) 			break; 	} while (addr = next, addr != end);

Fixed version (after fix):
 static int walk_hugetlb_range(unsigned long addr, unsigned long end, 	do { 		next = hugetlb_entry_end(h, addr, end); 		pte = huge_pte_offset(walk->mm, addr & hmask, sz);  		if (pte) 			err = walk->hugetlb_entry(pte, hmask, addr, next, walk); 		else if (walk->pte_hole) 			err = walk->pte_hole(addr, next, walk);  		if (err) 			break; 	} while (addr = next, addr != end);

Patch:
patch: @@ -188,8 +188,12 @@ static int walk_hugetlb_range(unsigned long addr, unsigned long end,
 	do {
 		next = hugetlb_entry_end(h, addr, end);
 		pte = huge_pte_offset(walk->mm, addr & hmask, sz);
-		if (pte && walk->hugetlb_entry)
+
+		if (pte)
 			err = walk->hugetlb_entry(pte, hmask, addr, next, walk);
+		else if (walk->pte_hole)
+			err = walk->pte_hole(addr, next, walk);
+
 		if (err)
 			break;
 	} while (addr = next, addr != end);
path: mm/pagewalk.c
Vulnerability: The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect sign extension.
Vulnerability ID: CVE-2017-16995
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-12-27
File: kernel/bpf/verifier.c
Commit message: bpf: fix incorrect sign extension in check_alu_op()

Distinguish between
BPF_ALU64|BPF_MOV|BPF_K (load 32-bit immediate, sign-extended to 64-bit)
and BPF_ALU|BPF_MOV|BPF_K (load 32-bit immediate, zero-padded to 64-bit);
only perform sign extension in the first case.

Starting with v4.14, this is exploitable by unprivileged users as long as
the unprivileged_bpf_disabled sysctl isn't set.

Debian assigned CVE-2017-16995 for this issue.

v3:
 - add CVE number (Ben Hutchings)

Fixes: 484611357c19 ("bpf: allow access into map value arrays")
Signed-off-by: Jann Horn <jannh@google.com>
Acked-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Commit author: Jann Horn

Vulnerable version (before fix):
 static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) 			 * remember the value we stored into this reg 			 */ 			regs[insn->dst_reg].type = SCALAR_VALUE; 			__mark_reg_known(regs + insn->dst_reg, insn->imm); 		}  	} else if (opcode > BPF_END) {

Fixed version (after fix):
 static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) 			 * remember the value we stored into this reg 			 */ 			regs[insn->dst_reg].type = SCALAR_VALUE; 			if (BPF_CLASS(insn->code) == BPF_ALU64) { 				__mark_reg_known(regs + insn->dst_reg, 						 insn->imm); 			} else { 				__mark_reg_known(regs + insn->dst_reg, 						 (u32)insn->imm); 			} 		}  	} else if (opcode > BPF_END) {

Patch:
patch: @@ -2408,7 +2408,13 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
 			 * remember the value we stored into this reg
 			 */
 			regs[insn->dst_reg].type = SCALAR_VALUE;
-			__mark_reg_known(regs + insn->dst_reg, insn->imm);
+			if (BPF_CLASS(insn->code) == BPF_ALU64) {
+				__mark_reg_known(regs + insn->dst_reg,
+						 insn->imm);
+			} else {
+				__mark_reg_known(regs + insn->dst_reg,
+						 (u32)insn->imm);
+			}
 		}
 
 	} else if (opcode > BPF_END) {
path: kernel/bpf/verifier.c
Vulnerability: In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.
Vulnerability ID: CVE-2017-17439
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/heimdal/heimdal
Published: 2017-12-06
File: kdc/kerberos5.c
Commit message: Security: Avoid NULL structure pointer member dereference

This can happen in the error path when processing malformed AS
requests with a NULL client name.  Bug originally introduced on
Fri Feb 13 09:26:01 2015 +0100 in commit:

    a873e21d7c06f22943a90a41dc733ae76799390d

    kdc: base _kdc_fast_mk_error() on krb5_mk_error_ext()

Original patch by Jeffrey Altman <jaltman@secure-endpoints.com>
Commit author: Viktor Dukhovni

Vulnerable version (before fix):
 _kdc_as_rep(kdc_request_t r,     /*      * In case of a non proxy error, build an error message.      */     if(ret != 0 && ret != HDB_ERR_NOT_FOUND_HERE && reply->length == 0) { 	ret = _kdc_fast_mk_error(context, r, 				 &error_method, 				 r->armor_crypto, 				 &req->req_body, 				 ret, r->e_text, 				 r->server_princ, 				 &r->client_princ->name, 				 &r->client_princ->realm, 				 NULL, NULL, 				 reply); 	if (ret)

Fixed version (after fix):
 _kdc_as_rep(kdc_request_t r,     /*      * In case of a non proxy error, build an error message.      */     if (ret != 0 && ret != HDB_ERR_NOT_FOUND_HERE && reply->length == 0) { 	ret = _kdc_fast_mk_error(context, r, 				 &error_method, 				 r->armor_crypto, 				 &req->req_body, 				 ret, r->e_text, 				 r->server_princ, 				 r->client_princ ?                                      &r->client_princ->name : NULL, 				 r->client_princ ?                                      &r->client_princ->realm : NULL, 				 NULL, NULL, 				 reply); 	if (ret)

Patch:
patch: @@ -2232,15 +2232,17 @@ _kdc_as_rep(kdc_request_t r,
     /*
      * In case of a non proxy error, build an error message.
      */
-    if(ret != 0 && ret != HDB_ERR_NOT_FOUND_HERE && reply->length == 0) {
+    if (ret != 0 && ret != HDB_ERR_NOT_FOUND_HERE && reply->length == 0) {
 	ret = _kdc_fast_mk_error(context, r,
 				 &error_method,
 				 r->armor_crypto,
 				 &req->req_body,
 				 ret, r->e_text,
 				 r->server_princ,
-				 &r->client_princ->name,
-				 &r->client_princ->realm,
+				 r->client_princ ?
+                                     &r->client_princ->name : NULL,
+				 r->client_princ ?
+                                     &r->client_princ->realm : NULL,
 				 NULL, NULL,
 				 reply);
 	if (ret)
path: kdc/kerberos5.c
Vulnerability: Cross site scripting (XSS) vulnerability in the markup_clean_href function in inc/conv.php in BlogoText through 3.7.6 allows remote attackers to inject arbitrary JavaScript via a comment.
Vulnerability ID: CVE-2017-17792
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/BlogoText/blogotext
Published: 2017-12-20
File: inc/conv.php
Commit message: fix security issue with comment
Commit author: RemRem

Vulnerable version (before fix):
 function parse_texte_code($texte, $code_before)  *  * @params array $matches, array from preg_replace_callback  * @return string  */ function markup_clean_href($matches) {     // var_dump($matches);     $allowed = array('http://', 'https://', 'ftp://');     // if not a valid url, return the string     if ((             !filter_var($matches['2'], FILTER_VALIDATE_URL)          || !preg_match('#^('.join('|', $allowed).')#i', $matches['2'])         )      && !preg_match('/^#[\w-_]+$/i', $matches['2']) // allowing [text|#look-at_this]     ) {         return $matches['0'];

Fixed version (after fix):
 function parse_texte_code($texte, $code_before)  *  * @params array $matches, array from preg_replace_callback  * @return string  *  * dirty fix, to do : review the htmlspecialchars policy before this function  */ function markup_clean_href($matches) {     $allowed = array('http://', 'https://', 'ftp://');      // remove the filter, currentlty doesn't work without working/reformating the submitted url, idn & others stuff...     // !filter_var($matches['2'], FILTER_VALIDATE_URL) ||       // encode < > ", ' allowed in url     $matches['2'] = htmlspecialchars(htmlspecialchars_decode($matches['2']), ENT_COMPAT);      // if not a valid url, return the string     if (!preg_match('#^('.join('|', $allowed).')#i', $matches['2'])      && !preg_match('/^#[\w-_]+$/i', $matches['2']) // allowing [text|#look-at_this]     ) {         return $matches['0'];

Patch:
patch: @@ -122,16 +122,21 @@ function parse_texte_code($texte, $code_before)
  *
  * @params array $matches, array from preg_replace_callback
  * @return string
+ *
+ * dirty fix, to do : review the htmlspecialchars policy before this function
  */
 function markup_clean_href($matches)
 {
-    // var_dump($matches);
     $allowed = array('http://', 'https://', 'ftp://');
+
+    // remove the filter, currentlty doesn't work without working/reformating the submitted url, idn & others stuff...
+    // !filter_var($matches['2'], FILTER_VALIDATE_URL) || 
+
+    // encode < > ", ' allowed in url
+    $matches['2'] = htmlspecialchars(htmlspecialchars_decode($matches['2']), ENT_COMPAT);
+
     // if not a valid url, return the string
-    if ((
-            !filter_var($matches['2'], FILTER_VALIDATE_URL)
-         || !preg_match('#^('.join('|', $allowed).')#i', $matches['2'])
-        )
+    if (!preg_match('#^('.join('|', $allowed).')#i', $matches['2'])
      && !preg_match('/^#[\w-_]+$/i', $matches['2']) // allowing [text|#look-at_this]
     ) {
         return $matches['0'];
path: inc/conv.php