rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation.
Vulnerability ID: CVE-2015-5706
CWE: CWE-416
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2015-08-31
File: fs/namei.c
Commit message: path_openat(): fix double fput()

path_openat() jumps to the wrong place after do_tmpfile() - it has
already done path_cleanup() (as part of path_lookupat() called by
do_tmpfile()), so doing that again can lead to double fput().

Cc: stable@vger.kernel.org	# v3.11+
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Commit author: Al Viro

Vulnerable version (before fix):
 static struct file *path_openat(int dfd, struct filename *pathname,  	if (unlikely(file->f_flags & __O_TMPFILE)) { 		error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened); 		goto out; 	}  	error = path_init(dfd, pathname, flags, nd); static struct file *path_openat(int dfd, struct filename *pathname, 	} out: 	path_cleanup(nd); 	if (!(opened & FILE_OPENED)) { 		BUG_ON(!error); 		put_filp(file);

Fixed version (after fix):
 static struct file *path_openat(int dfd, struct filename *pathname,  	if (unlikely(file->f_flags & __O_TMPFILE)) { 		error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened); 		goto out2; 	}  	error = path_init(dfd, pathname, flags, nd); static struct file *path_openat(int dfd, struct filename *pathname, 	} out: 	path_cleanup(nd); out2: 	if (!(opened & FILE_OPENED)) { 		BUG_ON(!error); 		put_filp(file);

Patch:
patch: @@ -3233,7 +3233,7 @@ static struct file *path_openat(int dfd, struct filename *pathname,
 
 	if (unlikely(file->f_flags & __O_TMPFILE)) {
 		error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened);
-		goto out;
+		goto out2;
 	}
 
 	error = path_init(dfd, pathname, flags, nd);
@@ -3263,6 +3263,7 @@ static struct file *path_openat(int dfd, struct filename *pathname,
 	}
 out:
 	path_cleanup(nd);
+out2:
 	if (!(opened & FILE_OPENED)) {
 		BUG_ON(!error);
 		put_filp(file);
path: fs/namei.c
Vulnerability: The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 allows remote authenticated users to bypass intended access restrictions, and arrange for a private post to be published and sticky, via unspecified vectors.
Vulnerability ID: CVE-2015-5715
CWE: CWE-264
Severity score: 2.9
Project: https://github.com/WordPress/WordPress
Published: 2016-05-22
File: wp-includes/class-wp-xmlrpc-server.php
Commit message: XMLRPC: Don't allow private posts to be sticky.

Merge of [34135] to the 4.3 branch.

See #20662.
Built from https://develop.svn.wordpress.org/branches/4.3@34151


git-svn-id: http://core.svn.wordpress.org/branches/4.3@34119 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Commit author: Dominik Schilling

Vulnerable version (before fix):
 public function mw_editPost( $args ) {  		$tags_input = isset( $content_struct['mt_keywords'] ) ? $content_struct['mt_keywords'] : null;  		if ( ('publish' == $post_status) ) { 			if ( ( 'page' == $post_type ) && ! current_user_can( 'publish_pages' ) ) { 				return new IXR_Error( 401, __( 'Sorry, you do not have the right to publish this page.' ) ); 			} elseif ( ! current_user_can( 'publish_posts' ) ) { 				return new IXR_Error( 401, __( 'Sorry, you do not have the right to publish this post.' ) );

Fixed version (after fix):
 public function mw_editPost( $args ) {  		$tags_input = isset( $content_struct['mt_keywords'] ) ? $content_struct['mt_keywords'] : null;  		if ( 'publish' == $post_status || 'private' == $post_status ) { 			if ( 'page' == $post_type && ! current_user_can( 'publish_pages' ) ) { 				return new IXR_Error( 401, __( 'Sorry, you do not have the right to publish this page.' ) ); 			} elseif ( ! current_user_can( 'publish_posts' ) ) { 				return new IXR_Error( 401, __( 'Sorry, you do not have the right to publish this post.' ) );

Patch:
patch: @@ -5234,8 +5234,8 @@ public function mw_editPost( $args ) {
 
 		$tags_input = isset( $content_struct['mt_keywords'] ) ? $content_struct['mt_keywords'] : null;
 
-		if ( ('publish' == $post_status) ) {
-			if ( ( 'page' == $post_type ) && ! current_user_can( 'publish_pages' ) ) {
+		if ( 'publish' == $post_status || 'private' == $post_status ) {
+			if ( 'page' == $post_type && ! current_user_can( 'publish_pages' ) ) {
 				return new IXR_Error( 401, __( 'Sorry, you do not have the right to publish this page.' ) );
 			} elseif ( ! current_user_can( 'publish_posts' ) ) {
 				return new IXR_Error( 401, __( 'Sorry, you do not have the right to publish this post.' ) );
path: wp-includes/class-wp-xmlrpc-server.php
Vulnerability: SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute arbitrary SQL commands via vectors involving the offset variable.
Vulnerability ID: CVE-2015-5725
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/bcit-ci/CodeIgniter
Published: 2018-02-21
File: system/database/DB_active_rec.php
Commit message: fixes potential SQL injection vector in Active Record offset()
Commit author: kenjis

Vulnerable version (before fix):
 public function limit($value, $offset = '') 	 */ 	public function offset($offset) 	{ 		$this->ar_offset = $offset; 		return $this; 	} 

Fixed version (after fix):
 public function limit($value, $offset = '') 	 */ 	public function offset($offset) 	{ 		$this->ar_offset = (int) $offset; 		return $this; 	} 

Patch:
patch: @@ -895,7 +895,7 @@ public function limit($value, $offset = '')
 	 */
 	public function offset($offset)
 	{
-		$this->ar_offset = $offset;
+		$this->ar_offset = (int) $offset;
 		return $this;
 	}
path: system/database/DB_active_rec.php
Vulnerability: Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.
Vulnerability ID: CVE-2015-5745
CWE: CWE-120
Severity score: 2.9
Project: https://github.com/qemu/qemu
Published: 2020-01-23
File: hw/char/virtio-serial-bus.c
Commit message: virtio-serial: fix ANY_LAYOUT

Don't assume a specific layout for control messages.
Required by virtio 1.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Amit Shah <amit.shah@redhat.com>
Reviewed-by: Jason Wang <jasowang@redhat.com>
Commit author: Michael S. Tsirkin

Vulnerable version (before fix):
 static size_t send_control_msg(VirtIOSerial *vser, void *buf, size_t len)         return 0;     }      memcpy(elem.in_sg[0].iov_base, buf, len);      virtqueue_push(vq, &elem, len);     virtio_notify(VIRTIO_DEVICE(vser), vq);

Fixed version (after fix):
 static size_t send_control_msg(VirtIOSerial *vser, void *buf, size_t len)         return 0;     }      /* TODO: detect a buffer that's too short, set NEEDS_RESET */     iov_from_buf(elem.in_sg, elem.in_num, 0, buf, len);      virtqueue_push(vq, &elem, len);     virtio_notify(VIRTIO_DEVICE(vser), vq);

Patch:
patch: @@ -195,7 +195,8 @@ static size_t send_control_msg(VirtIOSerial *vser, void *buf, size_t len)
         return 0;
     }
 
-    memcpy(elem.in_sg[0].iov_base, buf, len);
+    /* TODO: detect a buffer that's too short, set NEEDS_RESET */
+    iov_from_buf(elem.in_sg, elem.in_num, 0, buf, len);
 
     virtqueue_push(vq, &elem, len);
     virtio_notify(VIRTIO_DEVICE(vser), vq);
path: hw/char/virtio-serial-bus.c
Vulnerability: SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code.
Vulnerability ID: CVE-2015-5947
CWE: CWE-362
Severity score: 6.4
Project: https://github.com/salesagility/SuiteCRM
Published: 2017-09-06
File: modules/Configurator/UploadFileCheck.php
Commit message: Don't leave files which fail the upload check in the tmp company logo directory.
Commit author: Jim Mackin

Vulnerable version (before fix):
     if(!verify_uploaded_image($file_name, $returnArray['forQuotes'] == 'quotes')) {         $returnArray['data']='other';         $returnArray['path'] = '';     } else {         $img_size = getimagesize($file_name);         $filetype = $img_size['mime'];

Fixed version (after fix):
     if(!verify_uploaded_image($file_name, $returnArray['forQuotes'] == 'quotes')) {         $returnArray['data']='other';         $returnArray['path'] = '';         unlink($file_name);     } else {         $img_size = getimagesize($file_name);         $filetype = $img_size['mime'];

Patch:
patch: @@ -79,6 +79,7 @@
     if(!verify_uploaded_image($file_name, $returnArray['forQuotes'] == 'quotes')) {
         $returnArray['data']='other';
         $returnArray['path'] = '';
+        unlink($file_name);
     } else {
         $img_size = getimagesize($file_name);
         $filetype = $img_size['mime'];
path: modules/Configurator/UploadFileCheck.php
Vulnerability: Buffer overflow in the IGDstartelt function in igd_desc_parse.c in the MiniUPnP client (aka MiniUPnPc) before 1.9.20150917 allows remote UPNP servers to cause a denial of service (application crash) and possibly execute arbitrary code via an "oversized" XML element name.
Vulnerability ID: CVE-2015-6031
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/miniupnp/miniupnp
Published: 2015-11-02
File: miniupnpc/igd_desc_parse.c
Commit message: igd_desc_parse.c: fix buffer overflow
Commit author: Thomas Bernard

Vulnerable version (before fix):
 /* $Id: igd_desc_parse.c,v 1.16 2014/11/17 17:19:13 nanard Exp $ */ /* Project : miniupnp  * http://miniupnp.free.fr/  * Author : Thomas Bernard  * Copyright (c) 2005-2014 Thomas Bernard  * This software is subject to the conditions detailed in the  * LICENCE file provided in this distribution. */  void IGDstartelt(void * d, const char * name, int l) { 	struct IGDdatas * datas = (struct IGDdatas *)d; 	memcpy( datas->cureltname, name, l); 	datas->cureltname[l] = '\0'; 	datas->level++; 	if( (l==7) && !memcmp(name, "service", l) ) {

Fixed version (after fix):
 /* $Id: igd_desc_parse.c,v 1.17 2015/09/15 13:30:04 nanard Exp $ */ /* Project : miniupnp  * http://miniupnp.free.fr/  * Author : Thomas Bernard  * Copyright (c) 2005-2015 Thomas Bernard  * This software is subject to the conditions detailed in the  * LICENCE file provided in this distribution. */  void IGDstartelt(void * d, const char * name, int l) { 	struct IGDdatas * datas = (struct IGDdatas *)d; 	if(l >= MINIUPNPC_URL_MAXSIZE) 		l = MINIUPNPC_URL_MAXSIZE-1; 	memcpy(datas->cureltname, name, l); 	datas->cureltname[l] = '\0'; 	datas->level++; 	if( (l==7) && !memcmp(name, "service", l) ) {

Patch:
patch: @@ -1,8 +1,8 @@
-/* $Id: igd_desc_parse.c,v 1.16 2014/11/17 17:19:13 nanard Exp $ */
+/* $Id: igd_desc_parse.c,v 1.17 2015/09/15 13:30:04 nanard Exp $ */
 /* Project : miniupnp
  * http://miniupnp.free.fr/
  * Author : Thomas Bernard
- * Copyright (c) 2005-2014 Thomas Bernard
+ * Copyright (c) 2005-2015 Thomas Bernard
  * This software is subject to the conditions detailed in the
  * LICENCE file provided in this distribution. */
 
@@ -15,7 +15,9 @@
 void IGDstartelt(void * d, const char * name, int l)
 {
 	struct IGDdatas * datas = (struct IGDdatas *)d;
-	memcpy( datas->cureltname, name, l);
+	if(l >= MINIUPNPC_URL_MAXSIZE)
+		l = MINIUPNPC_URL_MAXSIZE-1;
+	memcpy(datas->cureltname, name, l);
 	datas->cureltname[l] = '\0';
 	datas->level++;
 	if( (l==7) && !memcmp(name, "service", l) ) {
path: miniupnpc/igd_desc_parse.c
Vulnerability: The vhost_dev_ioctl function in drivers/vhost/vhost.c in the Linux kernel before 4.1.5 allows local users to cause a denial of service (memory consumption) via a VHOST_SET_LOG_FD ioctl call that triggers permanent file-descriptor allocation.
Vulnerability ID: CVE-2015-6252
CWE: CWE-399
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2015-10-19
File: drivers/vhost/vhost.c
Commit message: vhost: actually track log eventfd file

While reviewing vhost log code, I found out that log_file is never
set. Note: I haven't tested the change (QEMU doesn't use LOG_FD yet).

Cc: stable@vger.kernel.org
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Commit author: Marc-André Lureau

Vulnerable version (before fix):
 long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp) 		} 		if (eventfp != d->log_file) { 			filep = d->log_file; 			ctx = d->log_ctx; 			d->log_ctx = eventfp ? 				eventfd_ctx_fileget(eventfp) : NULL;

Fixed version (after fix):
 long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp) 		} 		if (eventfp != d->log_file) { 			filep = d->log_file; 			d->log_file = eventfp; 			ctx = d->log_ctx; 			d->log_ctx = eventfp ? 				eventfd_ctx_fileget(eventfp) : NULL;

Patch:
patch: @@ -995,6 +995,7 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
 		}
 		if (eventfp != d->log_file) {
 			filep = d->log_file;
+			d->log_file = eventfp;
 			ctx = d->log_ctx;
 			d->log_ctx = eventfp ?
 				eventfd_ctx_fileget(eventfp) : NULL;
path: drivers/vhost/vhost.c
Vulnerability: The perf_callchain_user_64 function in arch/powerpc/perf/callchain.c in the Linux kernel before 4.0.2 on ppc64 platforms allows local users to cause a denial of service (infinite loop) via a deep 64-bit userspace backtrace.
Vulnerability ID: CVE-2015-6526
CWE: CWE-399
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2015-08-31
File: arch/powerpc/perf/callchain.c
Commit message: powerpc/perf: Cap 64bit userspace backtraces to PERF_MAX_STACK_DEPTH

We cap 32bit userspace backtraces to PERF_MAX_STACK_DEPTH
(currently 127), but we forgot to do the same for 64bit backtraces.

Cc: stable@vger.kernel.org
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Commit author: Anton Blanchard

Vulnerable version (before fix):
 static void perf_callchain_user_64(struct perf_callchain_entry *entry, 	sp = regs->gpr[1]; 	perf_callchain_store(entry, next_ip);  	for (;;) { 		fp = (unsigned long __user *) sp; 		if (!valid_user_sp(sp, 1) || read_user_stack_64(fp, &next_sp)) 			return;

Fixed version (after fix):
 static void perf_callchain_user_64(struct perf_callchain_entry *entry, 	sp = regs->gpr[1]; 	perf_callchain_store(entry, next_ip);  	while (entry->nr < PERF_MAX_STACK_DEPTH) { 		fp = (unsigned long __user *) sp; 		if (!valid_user_sp(sp, 1) || read_user_stack_64(fp, &next_sp)) 			return;

Patch:
patch: @@ -243,7 +243,7 @@ static void perf_callchain_user_64(struct perf_callchain_entry *entry,
 	sp = regs->gpr[1];
 	perf_callchain_store(entry, next_ip);
 
-	for (;;) {
+	while (entry->nr < PERF_MAX_STACK_DEPTH) {
 		fp = (unsigned long __user *) sp;
 		if (!valid_user_sp(sp, 1) || read_user_stack_64(fp, &next_sp))
 			return;
path: arch/powerpc/perf/callchain.c
Vulnerability: Use-after-free vulnerability in the mm_answer_pam_free_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms might allow local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request.
Vulnerability ID: CVE-2015-6564
CWE: CWE-264
Severity score: 10
Project: https://github.com/openssh/openssh-portable
Published: 2015-08-24
File: monitor.c
Commit message: set sshpam_ctxt to NULL after free

Avoids use-after-free in monitor when privsep child is compromised.
Reported by Moritz Jodeit; ok dtucker@
Commit author: Damien Miller

Vulnerable version (before fix):
 mm_answer_pam_respond(int sock, Buffer *m) int mm_answer_pam_free_ctx(int sock, Buffer *m) {  	debug3("%s", __func__); 	(sshpam_device.free_ctx)(sshpam_ctxt); 	buffer_clear(m); 	mm_request_send(sock, MONITOR_ANS_PAM_FREE_CTX, m); 	auth_method = "keyboard-interactive"; 	auth_submethod = "pam"; 	return (sshpam_authok == sshpam_ctxt); } #endif 

Fixed version (after fix):
 mm_answer_pam_respond(int sock, Buffer *m) int mm_answer_pam_free_ctx(int sock, Buffer *m) { 	int r = sshpam_authok != NULL && sshpam_authok == sshpam_ctxt;  	debug3("%s", __func__); 	(sshpam_device.free_ctx)(sshpam_ctxt); 	sshpam_ctxt = sshpam_authok = NULL; 	buffer_clear(m); 	mm_request_send(sock, MONITOR_ANS_PAM_FREE_CTX, m); 	auth_method = "keyboard-interactive"; 	auth_submethod = "pam"; 	return r; } #endif 

Patch:
patch: @@ -1166,14 +1166,16 @@ mm_answer_pam_respond(int sock, Buffer *m)
 int
 mm_answer_pam_free_ctx(int sock, Buffer *m)
 {
+	int r = sshpam_authok != NULL && sshpam_authok == sshpam_ctxt;
 
 	debug3("%s", __func__);
 	(sshpam_device.free_ctx)(sshpam_ctxt);
+	sshpam_ctxt = sshpam_authok = NULL;
 	buffer_clear(m);
 	mm_request_send(sock, MONITOR_ANS_PAM_FREE_CTX, m);
 	auth_method = "keyboard-interactive";
 	auth_submethod = "pam";
-	return (sshpam_authok == sshpam_ctxt);
+	return r;
 }
 #endif
path: monitor.c
Vulnerability: The Special:DeletedContributions page in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to determine if an IP is autoblocked via the "Change block" text.
Vulnerability ID: CVE-2015-6727
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/wikimedia/mediawiki
Published: 2015-09-01
File: includes/specials/SpecialDeletedContributions.php
Commit message: SECURITY: Don't disclose if an IP is autoblocked on Special:DeletedContributions

Same patch as dc2966bd05b, just for Special:DeletedContributions this
time.

Bug: T106893
Change-Id: I2089b21fc379b612fe9bf087b5f4ea75052bdbd3
Commit author: Kunal Mehta

Vulnerable version (before fix):
 function getSubTitle( $userObj ) { 			if ( ( $id !== null ) || ( $id === null && IP::isIPAddress( $nt->getText() ) ) ) { 				# Block / Change block / Unblock links 				if ( $this->getUser()->isAllowed( 'block' ) ) { 					if ( $userObj->isBlocked() ) { 						$tools[] = Linker::linkKnown( # Change block link 							SpecialPage::getTitleFor( 'Block', $nt->getDBkey() ), 							$this->msg( 'change-blocklink' )->escaped()

Fixed version (after fix):
 function getSubTitle( $userObj ) { 			if ( ( $id !== null ) || ( $id === null && IP::isIPAddress( $nt->getText() ) ) ) { 				# Block / Change block / Unblock links 				if ( $this->getUser()->isAllowed( 'block' ) ) { 					if ( $userObj->isBlocked() && $userObj->getBlock()->getType() !== Block::TYPE_AUTO ) { 						$tools[] = Linker::linkKnown( # Change block link 							SpecialPage::getTitleFor( 'Block', $nt->getDBkey() ), 							$this->msg( 'change-blocklink' )->escaped()

Patch:
patch: @@ -477,7 +477,7 @@ function getSubTitle( $userObj ) {
 			if ( ( $id !== null ) || ( $id === null && IP::isIPAddress( $nt->getText() ) ) ) {
 				# Block / Change block / Unblock links
 				if ( $this->getUser()->isAllowed( 'block' ) ) {
-					if ( $userObj->isBlocked() ) {
+					if ( $userObj->isBlocked() && $userObj->getBlock()->getType() !== Block::TYPE_AUTO ) {
 						$tools[] = Linker::linkKnown( # Change block link
 							SpecialPage::getTitleFor( 'Block', $nt->getDBkey() ),
 							$this->msg( 'change-blocklink' )->escaped()
path: includes/specials/SpecialDeletedContributions.php
Vulnerability: PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.
Vulnerability ID: CVE-2015-6817
CWE: CWE-287
Severity score: 6.4
Project: https://github.com/pgbouncer/pgbouncer
Published: 2017-05-23
File: src/client.c
Commit message: Remove too early set of auth_user

When query returns 0 rows (user not found),
this user stays as login user...

Should fix #69.
Commit author: Marko Kreen

Vulnerable version (before fix):
 static void start_auth_request(PgSocket *client, const char *username) 	int res; 	PktBuf *buf;  	client->auth_user = client->db->auth_user; 	/* have to fetch user info from db */ 	client->pool = get_pool(client->db, client->db->auth_user); 	if (!find_server(client)) {

Fixed version (after fix):
 static void start_auth_request(PgSocket *client, const char *username) 	int res; 	PktBuf *buf;  	/* have to fetch user info from db */ 	client->pool = get_pool(client->db, client->db->auth_user); 	if (!find_server(client)) {

Patch:
patch: @@ -83,7 +83,6 @@ static void start_auth_request(PgSocket *client, const char *username)
 	int res;
 	PktBuf *buf;
 
-	client->auth_user = client->db->auth_user;
 	/* have to fetch user info from db */
 	client->pool = get_pool(client->db, client->db->auth_user);
 	if (!find_server(client)) {
path: src/client.c
Vulnerability: Stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.
Vulnerability ID: CVE-2015-7510
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/keszybz/systemd
Published: 2017-09-25
File: src/nss-mymachines/nss-mymachines.c
Commit message: nss-mymachines: do not allow overlong machine names

https://github.com/systemd/systemd/issues/2002
Commit author: Zbigniew Jędrzejewski-Szmek

Vulnerable version (before fix):
 enum nss_status _nss_mymachines_getpwnam_r(         if (!e || e == p)                 goto not_found;          r = parse_uid(e + 1, &uid);         if (r < 0)                 goto not_found; enum nss_status _nss_mymachines_getgrnam_r(         if (!e || e == p)                 goto not_found;          r = parse_gid(e + 1, &gid);         if (r < 0)                 goto not_found;

Fixed version (after fix):
 enum nss_status _nss_mymachines_getpwnam_r(         if (!e || e == p)                 goto not_found;          if (e - p > HOST_NAME_MAX - 1) /* -1 for the last dash */                 goto not_found;          r = parse_uid(e + 1, &uid);         if (r < 0)                 goto not_found; enum nss_status _nss_mymachines_getgrnam_r(         if (!e || e == p)                 goto not_found;          if (e - p > HOST_NAME_MAX - 1)  /* -1 for the last dash */                 goto not_found;          r = parse_gid(e + 1, &gid);         if (r < 0)                 goto not_found;

Patch:
patch: @@ -416,6 +416,9 @@ enum nss_status _nss_mymachines_getpwnam_r(
         if (!e || e == p)
                 goto not_found;
 
+        if (e - p > HOST_NAME_MAX - 1) /* -1 for the last dash */
+                goto not_found;
+
         r = parse_uid(e + 1, &uid);
         if (r < 0)
                 goto not_found;
@@ -573,6 +576,9 @@ enum nss_status _nss_mymachines_getgrnam_r(
         if (!e || e == p)
                 goto not_found;
 
+        if (e - p > HOST_NAME_MAX - 1)  /* -1 for the last dash */
+                goto not_found;
+
         r = parse_gid(e + 1, &gid);
         if (r < 0)
                 goto not_found;
path: src/nss-mymachines/nss-mymachines.c
Vulnerability: Cross-site scripting (XSS) vulnerability in index.php in JosephErnest Void before 2015-10-02 allows remote attackers to inject arbitrary web script or HTML via a crafted URI.
Vulnerability ID: CVE-2015-7777
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/josephernest/void
Published: 2015-11-21
File: index.php
Commit message: Merge pull request #18 from g-sato/fix_security_bug

Security fix
Commit author: josephernest

Vulnerable version (before fix):
 function getpage($page)   <meta charset="utf-8">   <meta name="viewport" content="width=device-width, initial-scale=1.0">   <title><?php echo (trim($pagetitle) ? "$sitename - $pagetitle" : "$sitename")?></title>   <base href="<?php echo $siteroot; ?>">   <link rel="stylesheet" type="text/css" href="style.css"> </head> <body>

Fixed version (after fix):
 function getpage($page)   <meta charset="utf-8">   <meta name="viewport" content="width=device-width, initial-scale=1.0">   <title><?php echo (trim($pagetitle) ? "$sitename - $pagetitle" : "$sitename")?></title>   <base href="<?php echo htmlspecialchars($siteroot, ENT_QUOTES); ?>">   <link rel="stylesheet" type="text/css" href="style.css"> </head> <body>

Patch:
patch: @@ -31,7 +31,7 @@ function getpage($page)
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title><?php echo (trim($pagetitle) ? "$sitename - $pagetitle" : "$sitename")?></title>
-  <base href="<?php echo $siteroot; ?>">
+  <base href="<?php echo htmlspecialchars($siteroot, ENT_QUOTES); ?>">
   <link rel="stylesheet" type="text/css" href="style.css">
 </head>
 <body>
path: index.php