I am looking for a repository of real life vulnerabilities (in this specific situation, buffer overflows in C & C++) that have been detected in open source software. Ideally it would show exactly where in the code the vulnerabilities have occurred in the past, and how it was patched (if it is patched).
2
-
4you could search Github for CVEs in the "issues" section of repos ....– schroeder ♦May 15, 2016 at 20:36
-
You can search the CVE database for apps that you know to b3 open source and then look at their source code to find the fixes– Neil SmithlineMay 16, 2016 at 0:53
Add a comment
|
4 Answers
Check out exploitdb by Offensive Security: https://www.exploit-db.com/
Try this one (https://blogs.securiteam.com/index.php/archives/2543#more-2543), the advisory shows the vulnerable code and since it's an open source product the patch is available from the vendor source code (http://www.live555.com/liveMedia/public/).
answered May 15, 2016 at 11:32
Rapid7 is also a great place. You can try to run a granular google search there.
site:https://www.rapid7.com/ "CVE"
Most of the time you'll see great examples of vulnerabilities and threats along with where to find hotfixes for them.
As mentioned, exploit-db will have a solid repository of memory corruption bugs sorted by category. But you also asked for fixes; these are usually found on the vendors website under the name 'diffs' (differences)
