starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2020-1920 (published 2021-06-01T14:15Z)

A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-697
cwe_name: Incorrect Comparison
description: The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
extended_description: 
            This Pillar covers several possibilities:
               
                  the comparison checks one factor incorrectly;
                  the comparison should consider multiple factors, but it does not check at least one of those factors at all;
                  the comparison checks the wrong factor.
               
         
         

Fix information:
repo_url: https://github.com/facebook/react-native
commit_details: repo_url: https://github.com/facebook/react-native
author: Neal Poole
author_date: 2021-04-29 14:51:29-07:00
msg: Update validateBaseUrl to use latest regex

Summary:
Updating the regex to avoid a potential regular expression denial-of-service vulnerability.

Changelog: Update validateBaseUrl to use a more robust regular expression. Fixes CVE-2020-1920, GHSL-2020-293

Reviewed By: lunaleaps

Differential Revision: D25507604

fbshipit-source-id: c36a03c456881bc655c861e1a2c5cd41a7127c9d
repository: repo_url: https://github.com/facebook/react-native
repo_name: facebook/react-native
description: A framework for building native applications using React
repo_language: C++
owner: facebook
file_changes: filename: URL.js
change_type: ModificationType.MODIFY
diff: @@ -107,7 +107,7 @@ export class URLSearchParams {
 
 function validateBaseUrl(url: string) {
   // from this MIT-licensed gist: https://gist.github.com/dperini/729294
-  return /^(?:(?:(?:https?|ftp):)?\/\/)(?:(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z\u00a1-\uffff0-9]-*)*[a-z\u00a1-\uffff0-9]+)(?:\.(?:[a-z\u00a1-\uffff0-9]-*)*[a-z\u00a1-\uffff0-9]+)*(?:\.(?:[a-z\u00a1-\uffff]{2,}))?)(?::\d{2,5})?(?:[/?#]\S*)?$/i.test(
+  return /^(?:(?:(?:https?|ftp):)?\/\/)(?:(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z0-9\u00a1-\uffff][a-z0-9\u00a1-\uffff_-]{0,62})?[a-z0-9\u00a1-\uffff]\.)*(?:[a-z\u00a1-\uffff]{2,}\.?))(?::\d{2,5})?(?:[/?#]\S*)?$/.test(
     url,
   );
 }

programming_language: TypeScript
CVE-2011-4966 (published 2013-03-12T23:55Z)

modules/rlm_unix/rlm_unix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to authenticate using an expired password.

Severity: MEDIUM
CVSS v2 base score: 6.0 (AV:N/AC:M/Au:S/C:P/I:P/A:P)

Weakness information:
cwe_id: CWE-255
cwe_name: Credentials Management Errors
description: Weaknesses in this category are related to the management of credentials.

Fix information:
repo_url: https://github.com/alandekok/freeradius-server
commit_details: repo_url: https://github.com/alandekok/freeradius-server
author: Alan T. DeKok
author_date: 2012-02-07 20:58:52+01:00
msg: heck for account and password expiration
repository: repo_url: https://github.com/alandekok/freeradius-server
repo_name: alandekok/freeradius-server
description: Alan DeKok's private copy of the FreeRADIUS Server code.  Do NOT fork this.  Use the link below instead.
repo_language: C
owner: alandekok
file_changes: filename: rlm_unix.c
change_type: ModificationType.MODIFY
diff: @@ -272,9 +272,17 @@ static int unix_getpw(UNUSED void *instance, REQUEST *request,
 	/*
 	 *      Check if password has expired.
 	 */
+	if (spwd && spwd->sp_lstchg > 0 && spwd->sp_max >= 0 &&
+	    (request->timestamp / 86400) > (spwd->sp_lstchg + spwd->sp_max)) {
+		radlog_request(L_AUTH, 0, request, "[%s]: password has expired", name);
+		return RLM_MODULE_REJECT;
+	}
+	/*
+	 *      Check if account has expired.
+	 */
 	if (spwd && spwd->sp_expire > 0 &&
 	    (request->timestamp / 86400) > spwd->sp_expire) {
-		radlog_request(L_AUTH, 0, request, "[%s]: password has expired", name);
+		radlog_request(L_AUTH, 0, request, "[%s]: account has expired", name);
 		return RLM_MODULE_REJECT;
 	}
 #endif

programming_language: C
CVE-2017-13023 (published 2017-09-14T06:29Z)

The IPv6 mobility parser in tcpdump before 4.9.2 has a buffer over-read in print-mobility.c:mobility_opt_print().

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/the-tcpdump-group/tcpdump
commit_details: repo_url: https://github.com/the-tcpdump-group/tcpdump
author: Francois-Xavier Le Bail
author_date: 2017-03-22 16:08:25+01:00
msg: CVE-2017-13023/IPv6 mobility: Add a bounds check before fetching data

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't cause 'tcpdump: pcap_loop: truncated dump file'
repository: repo_url: https://github.com/the-tcpdump-group/tcpdump
repo_name: the-tcpdump-group/tcpdump
description: the TCPdump network dissector
repo_language: C
owner: the-tcpdump-group
file_changes: filename: print-mobility.c
change_type: ModificationType.MODIFY
diff: @@ -150,6 +150,7 @@ mobility_opt_print(netdissect_options *ndo,
 				goto trunc;
 			}
 			/* units of 4 secs */
+			ND_TCHECK_16BITS(&bp[i+2]);
 			ND_PRINT((ndo, "(refresh: %u)",
 				EXTRACT_16BITS(&bp[i+2]) << 2));
 			break;

programming_language: C
filename: TESTLIST
change_type: ModificationType.MODIFY
diff: @@ -524,6 +524,7 @@ pgm_opts_asan_2		pgm_opts_asan_2.pcap		pgm_opts_asan_2.out	-v
 vtp_asan		vtp_asan.pcap			vtp_asan.out	-v
 icmp6_mobileprefix_asan	icmp6_mobileprefix_asan.pcap	icmp6_mobileprefix_asan.out	-v
 ip_printroute_asan	ip_printroute_asan.pcap		ip_printroute_asan.out	-v
+mobility_opt_asan	mobility_opt_asan.pcap		mobility_opt_asan.out	-v
 
 # RTP tests
 # fuzzed pcap

programming_language: Shell
filename: mobility_opt_asan.out
change_type: ModificationType.ADD
diff: @@ -0,0 +1,2 @@
+IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62) payload length: 7168) d400:7fa1:0:400::6238:2949 > 9675:86dd:7300:2c:1c7f:ffff:ffc3:b2a1: mobility: BU seq#=116 A lifetime=15872(pad1)[|MOBILITY]
+IP6 (class 0x50, flowlabel 0x00004, hlim 0, next-header Mobile IP (old) (62) payload length: 7168) d4c3:b2a1:200:400::6238:2949 > 9675:86dd:73f0:2c:1c7f:ffff:ebc3:b291: mobility: BU seq#=116 A lifetime=15360[|MOBILITY]

programming_language: Batchfile
CVE-2022-36067 (published 2022-09-06T22:15Z)

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.

CVSS v3 base score: 10.0, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-913
cwe_name: Improper Control of Dynamically-Managed Code Resources
description: The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
extended_description: Many languages offer powerful features that allow the programmer to dynamically create or modify existing code, or resources used by code such as variables and objects. While these features can offer significant flexibility and reduce development time, they can be extremely dangerous if attackers can directly influence these code resources in unexpected ways.
         

Fix information:
repo_url: https://github.com/patriksimek/vm2
commit_details: repo_url: https://github.com/patriksimek/vm2
author: XmiliaH
author_date: 2022-08-28 15:50:12+02:00
msg: Fix 467
repository: repo_url: https://github.com/patriksimek/vm2
repo_name: patriksimek/vm2
description: Advanced vm/sandbox for Node.js
repo_language: JavaScript
owner: patriksimek
file_changes: filename: setup-sandbox.js
change_type: ModificationType.MODIFY
diff: @@ -67,7 +67,8 @@ Object.defineProperties(global, {
 	global: {value: global, writable: true, configurable: true, enumerable: true},
 	globalThis: {value: global, writable: true, configurable: true},
 	GLOBAL: {value: global, writable: true, configurable: true},
-	root: {value: global, writable: true, configurable: true}
+	root: {value: global, writable: true, configurable: true},
+	Error: {value: LocalError}
 });
 
 if (!localReflectDefineProperty(global, 'VMError', {

programming_language: JavaScript
filename: vm.js
change_type: ModificationType.MODIFY
diff: @@ -1070,6 +1070,13 @@ describe('VM', () => {
 			Error.prepareStackTrace = undefined;
 			stack.process
 		`));
+		assert.throws(()=>vm2.run(`(()=>{
+			const OldError = Error;
+			global.Error = {prepareStackTrace: (_, c) => c.map(c => c.getThis()).find(a => a && a.process)};
+			const { stack } = new OldError();
+			global.Error = OldError;
+			return stack.process.mainModule;
+		})()`));
 	});
 
 	it('Node internal prepareStackTrace attack', () => {

programming_language: JavaScript
CVE-2021-29537 (published 2021-05-14T20:15Z)

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow in `QuantizedResizeBilinear` by passing in invalid thresholds for the quantization. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/50711818d2e61ccce012591eeb4fdf93a8496726/tensorflow/core/kernels/quantized_resize_bilinear_op.cc#L705-L706) assumes that the 2 arguments are always valid scalars and tries to access the numeric value directly. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/tensorflow/tensorflow
commit_details: repo_url: https://github.com/tensorflow/tensorflow
author: Mihai Maruseac
author_date: 2021-04-21 17:00:39-07:00
msg: Validate min and max arguments to `QuantizedResizeBilinear`.

PiperOrigin-RevId: 369765091
Change-Id: I33be8b78273ab7d08b97541692fe05cb7f94963a
repository: repo_url: https://github.com/tensorflow/tensorflow
repo_name: tensorflow/tensorflow
description: An Open Source Machine Learning Framework for Everyone
repo_language: C++
owner: tensorflow
file_changes: filename: quantized_resize_bilinear_op.cc
change_type: ModificationType.MODIFY
diff: @@ -702,8 +702,14 @@ class QuantizedResizeBilinearOp : public OpKernel {
   }
 
   void Compute(OpKernelContext* context) override {
-    const float in_min = context->input(2).flat<float>()(0);
-    const float in_max = context->input(3).flat<float>()(0);
+    const auto& in_min_tensor = context->input(2);
+    OP_REQUIRES(context, TensorShapeUtils::IsScalar(in_min_tensor.shape()),
+                errors::InvalidArgument("min must be a scalar"));
+    const float in_min = in_min_tensor.flat<float>()(0);
+    const auto& in_max_tensor = context->input(3);
+    OP_REQUIRES(context, TensorShapeUtils::IsScalar(in_max_tensor.shape()),
+                errors::InvalidArgument("max must be a scalar"));
+    const float in_max = in_max_tensor.flat<float>()(0);
 
     ImageResizerState st(align_corners_, false);
     st.ValidateAndCreateOutput(context);

programming_language: C++
CVE-2015-8842 (published 2016-04-20T16:59Z)

tmpfiles.d/systemd.conf in systemd before 229 uses weak permissions for /var/log/journal/%m/system.journal, which allows local users to obtain sensitive information by reading the file.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 3.3, LOW (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/systemd/systemd
commit_details: repo_url: https://github.com/systemd/systemd
author: Zbigniew Jędrzejewski-Szmek
author_date: 2015-11-29 18:48:40-05:00
msg: tmpfiles: set acls on system.journal explicitly

https://github.com/systemd/systemd/issues/1397
repository: repo_url: https://github.com/systemd/systemd
repo_name: systemd/systemd
description: The systemd System and Service Manager 
repo_language: C
owner: systemd
file_changes: filename: systemd.conf.m4
change_type: ModificationType.MODIFY
diff: @@ -33,11 +33,13 @@ A+ /run/log/journal/%m - - - - group:adm:r-x,group:wheel:r-x
 
 z /var/log/journal 2755 root systemd-journal - -
 z /var/log/journal/%m 2755 root systemd-journal - -
+z /var/log/journal/%m/system.journal 0640 root systemd-journal - -
 m4_ifdef(`HAVE_ACL',``
 a+ /var/log/journal    - - - - d:group:adm:r-x,d:group:wheel:r-x
 a+ /var/log/journal    - - - - group:adm:r-x,group:wheel:r-x
 a+ /var/log/journal/%m - - - - d:group:adm:r-x,d:group:wheel:r-x
 a+ /var/log/journal/%m - - - - group:adm:r-x,group:wheel:r-x
+a+ /var/log/journal/%m/system.journal - - - - group:adm:r--,group:wheel:r--
 '')m4_dnl
 
 d /var/lib/systemd 0755 root root -

programming_language: Shell
CVE-2020-36625 (published 2022-12-22T10:15Z)

A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is bebd256fc3063111fb4503ca25e005ebf6e73780. It is recommended to apply a patch to fix this issue. The identifier VDB-216521 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/destinygg/chat
commit_details: repo_url: https://github.com/destinygg/chat
author: ILiedAboutCake
author_date: 2020-07-30 17:54:43-04:00
msg: Merge pull request #35 from 11k/fix-origin-check

Fix WebSocket upgrade CSRF vulnerability
repository: repo_url: https://github.com/destinygg/chat
repo_name: destinygg/chat
description: The chat back-end for destiny.gg, written in Go, based on Golem (github.com/trevex/golem)
repo_language: Go
owner: destinygg
CVE-2022-29190 (published 2022-05-21T00:15Z)

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infinite loop when processing. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-835
cwe_name: Loop with Unreachable Exit Condition ('Infinite Loop')
description: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
extended_description: If the loop can be influenced by an attacker, this weakness could allow attackers to consume excessive resources such as CPU or memory.
         

Fix information:
repo_url: https://github.com/pion/dtls
commit_details: repo_url: https://github.com/pion/dtls
author: Sean DuBois
author_date: 2022-05-10 12:52:59-04:00
msg: Don't attempt to append zero length fragments

Before the fragmentBuffer would process zero length fragments. Since
they are zero length the append would not do anything. This would
result in an infinite loop.
repository: repo_url: https://github.com/pion/dtls
repo_name: pion/dtls
description: DTLS 1.2 Server/Client implementation for Go
repo_language: Go
owner: pion
file_changes: filename: fragment_buffer.go
change_type: ModificationType.MODIFY
diff: @@ -76,7 +76,7 @@ func (f *fragmentBuffer) pop() (content []byte, epoch uint16) {
 		for _, f := range frags {
 			if f.handshakeHeader.FragmentOffset == targetOffset {
 				fragmentEnd := (f.handshakeHeader.FragmentOffset + f.handshakeHeader.FragmentLength)
-				if fragmentEnd != f.handshakeHeader.Length {
+				if fragmentEnd != f.handshakeHeader.Length && f.handshakeHeader.FragmentLength != 0 {
 					if !appendMessage(fragmentEnd) {
 						return false
 					}

programming_language: Go
filename: fragment_buffer_test.go
change_type: ModificationType.MODIFY
diff: @@ -73,6 +73,20 @@ func TestFragmentBuffer(t *testing.T) {
 			},
 			Epoch: 0,
 		},
+		// Assert that a zero length fragment doesn't cause the fragmentBuffer to enter an infinite loop
+		{
+			Name: "Zero Length Fragment",
+			In: [][]byte{
+				{
+					0x16, 0xfe, 0xfd, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0d, 0x00, 0x00,
+					0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+				},
+			},
+			Expected: [][]byte{
+				{0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00},
+			},
+			Epoch: 0,
+		},
 	} {
 		fragmentBuffer := newFragmentBuffer()
 		for _, frag := range test.In {

programming_language: Go
CVE-2020-22783 (published 2021-04-28T21:15Z)

Etherpad <1.8.3 stored passwords used by users insecurely in the database and in log files. This affects every database backend supported by Etherpad.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-312
cwe_name: Cleartext Storage of Sensitive Information
description: The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
extended_description: 
	 Because the information is stored in cleartext (i.e., unencrypted), attackers could potentially read it. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.
	 When organizations adopt cloud services, it can be easier for attackers to access the data from anywhere on the Internet.
	 In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
       
         

Fix information:
repo_url: https://github.com/ether/etherpad-lite
commit_details: repo_url: https://github.com/ether/etherpad-lite
author: John McLear
author_date: 2020-03-29 09:35:20+00:00
msg: SessionStore: replace password with PASSWORD_HIDDEN when storing in db

Fixes #3421.
repository: repo_url: https://github.com/ether/etherpad-lite
repo_name: ether/etherpad-lite
description: Etherpad: A modern really-real-time collaborative document editor.
repo_language: JavaScript
owner: ether
file_changes: filename: SessionStore.js
change_type: ModificationType.MODIFY
diff: @@ -38,6 +38,11 @@ SessionStore.prototype.get = function(sid, fn) {
 SessionStore.prototype.set = function(sid, sess, fn) {
   messageLogger.debug('SET ' + sid);
 
+  // don't store passwords in DB
+  if (sess.user && sess.user.password) {
+    sess.user.password = "PASSWORD_HIDDEN";
+  }
+
   db.set("sessionstorage:" + sid, sess);
   if (fn) {
     process.nextTick(fn);

programming_language: JavaScript
CVE-2017-13031 (published 2017-09-14T06:29Z)

The IPv6 fragmentation header parser in tcpdump before 4.9.2 has a buffer over-read in print-frag6.c:frag6_print().

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/the-tcpdump-group/tcpdump
commit_details: repo_url: https://github.com/the-tcpdump-group/tcpdump
author: Guy Harris
author_date: 2017-03-22 14:55:12-07:00
msg: CVE-2017-13031/Check for the presence of the entire IPv6 fragment header.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.

Clean up some whitespace in tests/TESTLIST while we're at it.
repository: repo_url: https://github.com/the-tcpdump-group/tcpdump
repo_name: the-tcpdump-group/tcpdump
description: the TCPdump network dissector
repo_language: C
owner: the-tcpdump-group
file_changes: filename: print-frag6.c
change_type: ModificationType.MODIFY
diff: @@ -41,7 +41,7 @@ frag6_print(netdissect_options *ndo, register const u_char *bp, register const u
 	dp = (const struct ip6_frag *)bp;
 	ip6 = (const struct ip6_hdr *)bp2;
 
-	ND_TCHECK(dp->ip6f_offlg);
+	ND_TCHECK(*dp);
 
 	if (ndo->ndo_vflag) {
 		ND_PRINT((ndo, "frag (0x%08x:%d|%ld)",

programming_language: C
filename: TESTLIST
change_type: ModificationType.MODIFY
diff: @@ -536,9 +536,10 @@ isis_stlv_asan-4	isis_stlv_asan-4.pcap		isis_stlv_asan-4.out	-v
 lldp_mgmt_addr_tlv_asan	lldp_mgmt_addr_tlv_asan.pcap	lldp_mgmt_addr_tlv_asan.out	-v
 bootp_asan		bootp_asan.pcap			bootp_asan.out		-v
 ppp_ccp_config_deflate_option_asan	ppp_ccp_config_deflate_option_asan.pcap	ppp_ccp_config_deflate_option_asan.out	-v
-pim_header_asan		pim_header_asan.pcap		pim_header_asan.out		-v
-pim_header_asan-2	pim_header_asan-2.pcap		pim_header_asan-2.out		-v
-pim_header_asan-3	pim_header_asan-3.pcap		pim_header_asan-3.out		-v
+pim_header_asan		pim_header_asan.pcap		pim_header_asan.out	-v
+pim_header_asan-2	pim_header_asan-2.pcap		pim_header_asan-2.out	-v
+pim_header_asan-3	pim_header_asan-3.pcap		pim_header_asan-3.out	-v
+ip6_frag_asan		ip6_frag_asan.pcap		ip6_frag_asan.out	-v
 
 # RTP tests
 # fuzzed pcap

programming_language: Shell
filename: ip6_frag_asan.out
change_type: ModificationType.ADD
diff: @@ -0,0 +1 @@
+IP6 (class 0x51, flowlabel 0xb2100, hlim 16, next-header Fragment (44) payload length: 27136) 452:22:19:0:41a:e4ff:10ff:484d > 2243:80:1400:100:19:ffff:ffff:fffb: [|frag]

programming_language: Batchfile