rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
Vulnerability ID: CVE-2016-6515
CWE: CWE-20
Severity score: 6.9
Project: https://github.com/openssh/openssh-portable
Published: 2016-08-07
File: auth-passwd.c
Commit message: upstream commit

Skip passwords longer than 1k in length so clients can't
easily DoS sshd by sending very long passwords, causing it to spend CPU
hashing them. feedback djm@, ok markus@.

Brought to our attention by tomas.kuthan at oracle.com, shilei-c at
360.cn and coredump at autistici.org

Upstream-ID: d0af7d4a2190b63ba1d38eec502bc4be0be9e333
Commit author: dtucker@openbsd.org

Vulnerable version (before fix):
 /* $OpenBSD: auth-passwd.c,v 1.44 2014/07/15 15:54:14 millert Exp $ */ /*  * Author: Tatu Ylonen <ylo@cs.hut.fi>  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland extern login_cap_t *lc; #define DAY		(24L * 60 * 60) /* 1 day in seconds */ #define TWO_WEEKS	(2L * 7 * DAY)	/* 2 weeks in seconds */  void disable_forwarding(void) { auth_password(Authctxt *authctxt, const char *password) 	static int expire_checked = 0; #endif  #ifndef HAVE_CYGWIN 	if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES) 		ok = 0;

Fixed version (after fix):
 /* $OpenBSD: auth-passwd.c,v 1.45 2016/07/21 01:39:35 dtucker Exp $ */ /*  * Author: Tatu Ylonen <ylo@cs.hut.fi>  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland extern login_cap_t *lc; #define DAY		(24L * 60 * 60) /* 1 day in seconds */ #define TWO_WEEKS	(2L * 7 * DAY)	/* 2 weeks in seconds */  #define MAX_PASSWORD_LEN	1024  void disable_forwarding(void) { auth_password(Authctxt *authctxt, const char *password) 	static int expire_checked = 0; #endif  	if (strlen(password) > MAX_PASSWORD_LEN) 		return 0;  #ifndef HAVE_CYGWIN 	if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES) 		ok = 0;

Patch:
patch: @@ -1,4 +1,4 @@
-/* $OpenBSD: auth-passwd.c,v 1.44 2014/07/15 15:54:14 millert Exp $ */
+/* $OpenBSD: auth-passwd.c,v 1.45 2016/07/21 01:39:35 dtucker Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -66,6 +66,8 @@ extern login_cap_t *lc;
 #define DAY		(24L * 60 * 60) /* 1 day in seconds */
 #define TWO_WEEKS	(2L * 7 * DAY)	/* 2 weeks in seconds */
 
+#define MAX_PASSWORD_LEN	1024
+
 void
 disable_forwarding(void)
 {
@@ -87,6 +89,9 @@ auth_password(Authctxt *authctxt, const char *password)
 	static int expire_checked = 0;
 #endif
 
+	if (strlen(password) > MAX_PASSWORD_LEN)
+		return 0;
+
 #ifndef HAVE_CYGWIN
 	if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES)
 		ok = 0;
path: auth-passwd.c
Vulnerability: Race condition in the ioctl_file_dedupe_range function in fs/ioctl.c in the Linux kernel through 4.7 allows local users to cause a denial of service (heap-based buffer overflow) or possibly gain privileges by changing a certain count value, aka a "double fetch" vulnerability.
Vulnerability ID: CVE-2016-6516
CWE: CWE-362
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2016-08-06
File: fs/ioctl.c
Commit message: vfs: ioctl: prevent double-fetch in dedupe ioctl

This prevents a double-fetch from user space that can lead to to an
undersized allocation and heap overflow.

Fixes: 54dbc1517237 ("vfs: hoist the btrfs deduplication ioctl to the vfs")
Signed-off-by: Scott Bauer <sbauer@plzdonthack.me>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Scott Bauer

Vulnerable version (before fix):
 static long ioctl_file_dedupe_range(struct file *file, void __user *arg) 		goto out; 	}  	ret = vfs_dedupe_file_range(file, same); 	if (ret) 		goto out;

Fixed version (after fix):
 static long ioctl_file_dedupe_range(struct file *file, void __user *arg) 		goto out; 	}  	same->dest_count = count; 	ret = vfs_dedupe_file_range(file, same); 	if (ret) 		goto out;

Patch:
patch: @@ -590,6 +590,7 @@ static long ioctl_file_dedupe_range(struct file *file, void __user *arg)
 		goto out;
 	}
 
+	same->dest_count = count;
 	ret = vfs_dedupe_file_range(file, same);
 	if (ret)
 		goto out;
path: fs/ioctl.c
Vulnerability: Race condition in the ioctl_file_dedupe_range function in fs/ioctl.c in the Linux kernel through 4.7 allows local users to cause a denial of service (heap-based buffer overflow) or possibly gain privileges by changing a certain count value, aka a "double fetch" vulnerability.
Vulnerability ID: CVE-2016-6516
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2016-08-06
File: fs/ioctl.c
Commit message: vfs: ioctl: prevent double-fetch in dedupe ioctl

This prevents a double-fetch from user space that can lead to to an
undersized allocation and heap overflow.

Fixes: 54dbc1517237 ("vfs: hoist the btrfs deduplication ioctl to the vfs")
Signed-off-by: Scott Bauer <sbauer@plzdonthack.me>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Scott Bauer

Vulnerable version (before fix):
 static long ioctl_file_dedupe_range(struct file *file, void __user *arg) 		goto out; 	}  	ret = vfs_dedupe_file_range(file, same); 	if (ret) 		goto out;

Fixed version (after fix):
 static long ioctl_file_dedupe_range(struct file *file, void __user *arg) 		goto out; 	}  	same->dest_count = count; 	ret = vfs_dedupe_file_range(file, same); 	if (ret) 		goto out;

Patch:
patch: @@ -590,6 +590,7 @@ static long ioctl_file_dedupe_range(struct file *file, void __user *arg)
 		goto out;
 	}
 
+	same->dest_count = count;
 	ret = vfs_dedupe_file_range(file, same);
 	if (ret)
 		goto out;
path: fs/ioctl.c
Vulnerability: Cross-site scripting (XSS) vulnerability in MantisBT Filter API in MantisBT versions before 1.2.19, and versions 2.0.0-beta1, 1.3.0-beta1 allows remote attackers to inject arbitrary web script or HTML via the 'view_type' parameter.
Vulnerability ID: CVE-2016-6837
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/mantisbt/mantisbt
Published: 2017-01-10
File: core/filter_api.php
Commit message: Fix XSS in view_all_bug_page.php

The value of the view_type parameter on the view_all_bug_page.php page
was not encoded before being displayed.

This vulnerability was discovered by Will Dollman of Netcraft Ltd.

Initial patch modified to use strict comparison per Will's suggestion.

Fixes #21611
Commit author: Damien Regad

Vulnerable version (before fix):
 function filter_ensure_valid_filter( array $p_filter_arr ) { 		# if the version is old, update it 		$p_filter_arr['_version'] = FILTER_VERSION; 	} 	if( !isset( $p_filter_arr['_view_type'] ) ) { 		$p_filter_arr['_view_type'] = gpc_get_string( 'view_type', 'simple' ); 	} 	if( !isset( $p_filter_arr[FILTER_PROPERTY_ISSUES_PER_PAGE] ) ) { 		$p_filter_arr[FILTER_PROPERTY_ISSUES_PER_PAGE] = gpc_get_int( FILTER_PROPERTY_ISSUES_PER_PAGE, config_get( 'default_limit_view' ) ); 	}

Fixed version (after fix):
 function filter_ensure_valid_filter( array $p_filter_arr ) { 		# if the version is old, update it 		$p_filter_arr['_version'] = FILTER_VERSION; 	}  	# Filter view type - ensure it's either 'simple' or 'advanced' (prevent XSS) 	if( !isset( $p_filter_arr['_view_type'] ) ) { 		$p_filter_arr['_view_type'] = gpc_get_string( 'view_type', 'simple' ); 	} 	if( $p_filter_arr['_view_type'] !== 'advanced' ) { 		$p_filter_arr['_view_type'] = 'simple'; 	}  	if( !isset( $p_filter_arr[FILTER_PROPERTY_ISSUES_PER_PAGE] ) ) { 		$p_filter_arr[FILTER_PROPERTY_ISSUES_PER_PAGE] = gpc_get_int( FILTER_PROPERTY_ISSUES_PER_PAGE, config_get( 'default_limit_view' ) ); 	}

Patch:
patch: @@ -489,9 +489,15 @@ function filter_ensure_valid_filter( array $p_filter_arr ) {
 		# if the version is old, update it
 		$p_filter_arr['_version'] = FILTER_VERSION;
 	}
+
+	# Filter view type - ensure it's either 'simple' or 'advanced' (prevent XSS)
 	if( !isset( $p_filter_arr['_view_type'] ) ) {
 		$p_filter_arr['_view_type'] = gpc_get_string( 'view_type', 'simple' );
 	}
+	if( $p_filter_arr['_view_type'] !== 'advanced' ) {
+		$p_filter_arr['_view_type'] = 'simple';
+	}
+
 	if( !isset( $p_filter_arr[FILTER_PROPERTY_ISSUES_PER_PAGE] ) ) {
 		$p_filter_arr[FILTER_PROPERTY_ISSUES_PER_PAGE] = gpc_get_int( FILTER_PROPERTY_ISSUES_PER_PAGE, config_get( 'default_limit_view' ) );
 	}
path: core/filter_api.php
Vulnerability: ext/curl/interface.c in PHP 7.x before 7.0.10 does not work around a libcurl integer overflow, which allows remote attackers to cause a denial of service (allocation error and heap-based buffer overflow) or possibly have unspecified other impact via a long string that is mishandled in a curl_escape call.
Vulnerability ID: CVE-2016-7134
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/php/php-src
Published: 2016-09-12
File: ext/curl/interface.c
Commit message: Fix bug #72674 - check both curl_escape and curl_unescape
Commit author: Stanislav Malyshev

Vulnerable version (before fix):
 PHP_FUNCTION(curl_reset) PHP_FUNCTION(curl_escape) { 	char       *str = NULL, *res = NULL; 	size_t        str_len = 0; 	zval       *zid; 	php_curl   *ch;  PHP_FUNCTION(curl_escape) 		RETURN_FALSE; 	}  	if ((res = curl_easy_escape(ch->cp, str, str_len))) { 		RETVAL_STRING(res); 		curl_free(res); PHP_FUNCTION(curl_unescape) 		RETURN_FALSE; 	}  	if (str_len > INT_MAX) { 		RETURN_FALSE; 	} 

Fixed version (after fix):
 PHP_FUNCTION(curl_reset) PHP_FUNCTION(curl_escape) { 	char       *str = NULL, *res = NULL; 	size_t     str_len = 0; 	zval       *zid; 	php_curl   *ch;  PHP_FUNCTION(curl_escape) 		RETURN_FALSE; 	}  	if (ZEND_SIZE_T_INT_OVFL(str_len)) { 		RETURN_FALSE; 	}  	if ((res = curl_easy_escape(ch->cp, str, str_len))) { 		RETVAL_STRING(res); 		curl_free(res); PHP_FUNCTION(curl_unescape) 		RETURN_FALSE; 	}  	if (ZEND_SIZE_T_INT_OVFL(str_len)) { 		RETURN_FALSE; 	} 

Patch:
patch: @@ -3517,7 +3517,7 @@ PHP_FUNCTION(curl_reset)
 PHP_FUNCTION(curl_escape)
 {
 	char       *str = NULL, *res = NULL;
-	size_t        str_len = 0;
+	size_t     str_len = 0;
 	zval       *zid;
 	php_curl   *ch;
 
@@ -3529,6 +3529,10 @@ PHP_FUNCTION(curl_escape)
 		RETURN_FALSE;
 	}
 
+	if (ZEND_SIZE_T_INT_OVFL(str_len)) {
+		RETURN_FALSE;
+	}
+
 	if ((res = curl_easy_escape(ch->cp, str, str_len))) {
 		RETVAL_STRING(res);
 		curl_free(res);
@@ -3556,7 +3560,7 @@ PHP_FUNCTION(curl_unescape)
 		RETURN_FALSE;
 	}
 
-	if (str_len > INT_MAX) {
+	if (ZEND_SIZE_T_INT_OVFL(str_len)) {
 		RETURN_FALSE;
 	}
path: ext/curl/interface.c
Vulnerability: The m_sasl module in InspIRCd before 2.0.23, when used with a service that supports SASL_EXTERNAL authentication, allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted SASL message.
Vulnerability ID: CVE-2016-7142
CWE: CWE-264
Severity score: 2.9
Project: https://github.com/inspircd/inspircd
Published: 2016-09-26
File: src/modules/m_sasl.cpp
Commit message: m_sasl: don't allow AUTHENTICATE with mechanisms with a space
Commit author: Adam

Vulnerable version (before fix):
 class CommandAuthenticate : public Command 		: Command(Creator, "AUTHENTICATE", 1), authExt(ext), cap(Cap) 	{ 		works_before_reg = true; 	}  	CmdResult Handle (const std::vector<std::string>& parameters, User *user) class CommandAuthenticate : public Command 			if (!cap.ext.get(user)) 				return CMD_FAILURE;  			SaslAuthenticator *sasl = authExt.get(user); 			if (!sasl) 				authExt.set(user, new SaslAuthenticator(user, parameters[0]));

Fixed version (after fix):
 class CommandAuthenticate : public Command 		: Command(Creator, "AUTHENTICATE", 1), authExt(ext), cap(Cap) 	{ 		works_before_reg = true; 		allow_empty_last_param = false; 	}  	CmdResult Handle (const std::vector<std::string>& parameters, User *user) class CommandAuthenticate : public Command 			if (!cap.ext.get(user)) 				return CMD_FAILURE;  			if (parameters[0].find(' ') != std::string::npos || parameters[0][0] == ':') 				return CMD_FAILURE;  			SaslAuthenticator *sasl = authExt.get(user); 			if (!sasl) 				authExt.set(user, new SaslAuthenticator(user, parameters[0]));

Patch:
patch: @@ -189,6 +189,7 @@ class CommandAuthenticate : public Command
 		: Command(Creator, "AUTHENTICATE", 1), authExt(ext), cap(Cap)
 	{
 		works_before_reg = true;
+		allow_empty_last_param = false;
 	}
 
 	CmdResult Handle (const std::vector<std::string>& parameters, User *user)
@@ -199,6 +200,9 @@ class CommandAuthenticate : public Command
 			if (!cap.ext.get(user))
 				return CMD_FAILURE;
 
+			if (parameters[0].find(' ') != std::string::npos || parameters[0][0] == ':')
+				return CMD_FAILURE;
+
 			SaslAuthenticator *sasl = authExt.get(user);
 			if (!sasl)
 				authExt.set(user, new SaslAuthenticator(user, parameters[0]));
path: src/modules/m_sasl.cpp
Vulnerability: The m_authenticate function in modules/m_sasl.c in UnrealIRCd before 3.2.10.7 and 4.x before 4.0.6 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.
Vulnerability ID: CVE-2016-7144
CWE: CWE-287
Severity score: 6.4
Project: https://github.com/unrealircd/unrealircd
Published: 2017-01-18
File: src/modules/m_sasl.c
Commit message: Fix AUTHENTICATE bug
Commit author: Bram Matthys

Vulnerable version (before fix):
 CMD_FUNC(m_authenticate) 		return 0; 	}  	if (strlen(parv[1]) > 400) 	{ 		sendto_one(sptr, err_str(ERR_SASLTOOLONG), me.name, BadPtr(sptr->name) ? "*" : sptr->name);

Fixed version (after fix):
 CMD_FUNC(m_authenticate) 		return 0; 	}  	if ((parv[1][0] == ':') || strchr(parv[1], ' ')) 	{ 		sendto_one(sptr, err_str(ERR_CANNOTDOCOMMAND), me.name, "*", "AUTHENTICATE", "Invalid parameter"); 		return 0; 	}  	if (strlen(parv[1]) > 400) 	{ 		sendto_one(sptr, err_str(ERR_SASLTOOLONG), me.name, BadPtr(sptr->name) ? "*" : sptr->name);

Patch:
patch: @@ -230,6 +230,12 @@ CMD_FUNC(m_authenticate)
 		return 0;
 	}
 
+	if ((parv[1][0] == ':') || strchr(parv[1], ' '))
+	{
+		sendto_one(sptr, err_str(ERR_CANNOTDOCOMMAND), me.name, "*", "AUTHENTICATE", "Invalid parameter");
+		return 0;
+	}
+
 	if (strlen(parv[1]) > 400)
 	{
 		sendto_one(sptr, err_str(ERR_SASLTOOLONG), me.name, BadPtr(sptr->name) ? "*" : sptr->name);
path: src/modules/m_sasl.c
Vulnerability: The m_authenticate function in ircd/m_authenticate.c in nefarious2 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.
Vulnerability ID: CVE-2016-7145
CWE: CWE-287
Severity score: 6.4
Project: https://github.com/evilnet/nefarious2
Published: 2017-03-07
File: ircd/m_authenticate.c
Commit message: Fix to prevent SASL security vulnerability
Commit author: Matthew Beeching

Vulnerable version (before fix):
 int m_authenticate(struct Client* cptr, struct Client* sptr, int parc, char* par    if (acptr) {     if (first) {       if (!EmptyString(cli_sslclifp(cptr)))         sendcmdto_one(&me, CMD_SASL, acptr, "%C %C!%u.%u S %s :%s", acptr, &me,                       cli_fd(cptr), cli_saslcookie(cptr), int m_authenticate(struct Client* cptr, struct Client* sptr, int parc, char* par     }   } else {     if (first) {       if (!EmptyString(cli_sslclifp(cptr)))         sendcmdto_serv_butone(&me, CMD_SASL, cptr, "* %C!%u.%u S %s :%s", &me,                               cli_fd(cptr), cli_saslcookie(cptr),

Fixed version (after fix):
 int m_authenticate(struct Client* cptr, struct Client* sptr, int parc, char* par    if (acptr) {     if (first) {       if (*parv[1] == ':' || strchr(parv[1], ' ')) 		return exit_client(cptr, sptr, sptr, "Malformed AUTHENTICATE");       if (!EmptyString(cli_sslclifp(cptr)))         sendcmdto_one(&me, CMD_SASL, acptr, "%C %C!%u.%u S %s :%s", acptr, &me,                       cli_fd(cptr), cli_saslcookie(cptr), int m_authenticate(struct Client* cptr, struct Client* sptr, int parc, char* par     }   } else {     if (first) {       if (*parv[1] == ':' || strchr(parv[1], ' '))         return exit_client(cptr, sptr, sptr, "Malformed AUTHENTICATE");       if (!EmptyString(cli_sslclifp(cptr)))         sendcmdto_serv_butone(&me, CMD_SASL, cptr, "* %C!%u.%u S %s :%s", &me,                               cli_fd(cptr), cli_saslcookie(cptr),

Patch:
patch: @@ -150,6 +150,8 @@ int m_authenticate(struct Client* cptr, struct Client* sptr, int parc, char* par
 
   if (acptr) {
     if (first) {
+      if (*parv[1] == ':' || strchr(parv[1], ' '))
+		return exit_client(cptr, sptr, sptr, "Malformed AUTHENTICATE");
       if (!EmptyString(cli_sslclifp(cptr)))
         sendcmdto_one(&me, CMD_SASL, acptr, "%C %C!%u.%u S %s :%s", acptr, &me,
                       cli_fd(cptr), cli_saslcookie(cptr),
@@ -167,6 +169,8 @@ int m_authenticate(struct Client* cptr, struct Client* sptr, int parc, char* par
     }
   } else {
     if (first) {
+      if (*parv[1] == ':' || strchr(parv[1], ' '))
+        return exit_client(cptr, sptr, sptr, "Malformed AUTHENTICATE");
       if (!EmptyString(cli_sslclifp(cptr)))
         sendcmdto_serv_butone(&me, CMD_SASL, cptr, "* %C!%u.%u S %s :%s", &me,
                               cli_fd(cptr), cli_saslcookie(cptr),
path: ircd/m_authenticate.c
Vulnerability: Cross-site scripting (XSS) vulnerability in b2evolution 6.7.5 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the site name.
Vulnerability ID: CVE-2016-7150
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/b2evolution/b2evolution
Published: 2017-01-18
File: skins_site/_site_body_header.inc.php
Commit message: Fix XSS vulnerability on "site name"
Commit author: yurabakhtin

Vulnerable version (before fix):
 <?php if( $Settings->get( 'notification_logo' ) != '' ) { 	$site_title = $Settings->get( 'notification_long_name' ) != '' ? ' title="'.$Settings->get( 'notification_long_name' ).'"' : ''; 	$site_name_text = '<img src="'.$Settings->get( 'notification_logo' ).'" alt="'.$Settings->get( 'notification_short_name' ).'"'.$site_title.' />'; 	$site_title_class = ' swhead_logo'; } else

Fixed version (after fix):
 <?php if( $Settings->get( 'notification_logo' ) != '' ) { 	$site_title = $Settings->get( 'notification_long_name' ) != '' ? ' title="'.format_to_output( $Settings->get( 'notification_long_name' ), 'htmlattr' ).'"' : ''; 	$site_name_text = '<img src="'.$Settings->get( 'notification_logo' ).'" alt="'.format_to_output( $Settings->get( 'notification_short_name' ), 'htmlattr' ).'"'.$site_title.' />'; 	$site_title_class = ' swhead_logo'; } else

Patch:
patch: @@ -17,8 +17,8 @@
 <?php
 if( $Settings->get( 'notification_logo' ) != '' )
 {
-	$site_title = $Settings->get( 'notification_long_name' ) != '' ? ' title="'.$Settings->get( 'notification_long_name' ).'"' : '';
-	$site_name_text = '<img src="'.$Settings->get( 'notification_logo' ).'" alt="'.$Settings->get( 'notification_short_name' ).'"'.$site_title.' />';
+	$site_title = $Settings->get( 'notification_long_name' ) != '' ? ' title="'.format_to_output( $Settings->get( 'notification_long_name' ), 'htmlattr' ).'"' : '';
+	$site_name_text = '<img src="'.$Settings->get( 'notification_logo' ).'" alt="'.format_to_output( $Settings->get( 'notification_short_name' ), 'htmlattr' ).'"'.$site_title.' />';
 	$site_title_class = ' swhead_logo';
 }
 else
path: skins_site/_site_body_header.inc.php
Vulnerability: The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.
Vulnerability ID: CVE-2016-7405
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/ADOdb/ADOdb
Published: 2016-10-03
File: drivers/adodb-pdo.inc.php
Commit message: PDO: fix incorrect quoting allowing SQL injection

The PDO driver was relying on ADOConnection::qstr() for quoting strings.
An application relying on qstr() to manually prepare SQL statements
rather than using parameterized queries may be vulnerable to SQL
injection attacks, as demonstrated by @jdavidlists.

This commit delegates string quoting to PDO::quote() when a connection
is available. If not, it simply replaces single quotes by the value of
$replaceQuote property.

Fixes #226
Commit author: Damien Regad

Vulnerable version (before fix):
 function _insertid() 	{ 		return ($this->_connectionID) ? $this->_connectionID->lastInsertId() : 0; 	} }  class ADODB_pdo_base extends ADODB_pdo {

Fixed version (after fix):
 function _insertid() 	{ 		return ($this->_connectionID) ? $this->_connectionID->lastInsertId() : 0; 	}  	/** 	 * Quotes a string to be sent to the database. 	 * If we have an active connection, delegates quoting to the underlying 	 * PDO object. Otherwise, replace "'" by the value of $replaceQuote (same 	 * behavior as mysqli driver) 	 * @param string  $s            The string to quote 	 * @param boolean $magic_quotes If false, use PDO::quote(). 	 * @return string Quoted string 	 */ 	function qstr($s, $magic_quotes = false) 	{ 		if (!$magic_quotes) { 			if ($this->_connectionID) { 				return $this->_connectionID->quote($s); 			} 			return "'" . str_replace("'", $this->replaceQuote, $s) . "'"; 		}  		// undo magic quotes for " 		$s = str_replace('\\"', '"', $s); 		return "'$s'"; 	}  }  class ADODB_pdo_base extends ADODB_pdo {

Patch:
patch: @@ -518,6 +518,30 @@ function _insertid()
 	{
 		return ($this->_connectionID) ? $this->_connectionID->lastInsertId() : 0;
 	}
+
+	/**
+	 * Quotes a string to be sent to the database.
+	 * If we have an active connection, delegates quoting to the underlying
+	 * PDO object. Otherwise, replace "'" by the value of $replaceQuote (same
+	 * behavior as mysqli driver)
+	 * @param string  $s            The string to quote
+	 * @param boolean $magic_quotes If false, use PDO::quote().
+	 * @return string Quoted string
+	 */
+	function qstr($s, $magic_quotes = false)
+	{
+		if (!$magic_quotes) {
+			if ($this->_connectionID) {
+				return $this->_connectionID->quote($s);
+			}
+			return "'" . str_replace("'", $this->replaceQuote, $s) . "'";
+		}
+
+		// undo magic quotes for "
+		$s = str_replace('\\"', '"', $s);
+		return "'$s'";
+	}
+
 }
 
 class ADODB_pdo_base extends ADODB_pdo {
path: drivers/adodb-pdo.inc.php
Vulnerability: ext/intl/msgformat/msgformat_format.c in PHP before 5.6.26 and 7.x before 7.0.11 does not properly restrict the locale length provided to the Locale class in the ICU library, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a MessageFormatter::formatMessage call with a long first argument.
Vulnerability ID: CVE-2016-7416
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/php/php-src
Published: 2016-09-17
File: ext/intl/msgformat/msgformat_format.c
Commit message: Fix bug #73007: add locale length check
Commit author: Stanislav Malyshev

Vulnerable version (before fix):
 PHP_FUNCTION( msgfmt_format_message ) 		RETURN_FALSE; 	}  	msgformat_data_init(&mfo->mf_data TSRMLS_CC);  	if(pattern && pattern_len) {

Fixed version (after fix):
 PHP_FUNCTION( msgfmt_format_message ) 		RETURN_FALSE; 	}  	INTL_CHECK_LOCALE_LEN(slocale_len);  	msgformat_data_init(&mfo->mf_data TSRMLS_CC);  	if(pattern && pattern_len) {

Patch:
patch: @@ -117,6 +117,8 @@ PHP_FUNCTION( msgfmt_format_message )
 		RETURN_FALSE;
 	}
 
+	INTL_CHECK_LOCALE_LEN(slocale_len);
+
 	msgformat_data_init(&mfo->mf_data TSRMLS_CC);
 
 	if(pattern && pattern_len) {
path: ext/intl/msgformat/msgformat_format.c