0

I am looking for a repository of real life vulnerabilities (in this specific situation, buffer overflows in C & C++) that have been detected in open source software. Ideally it would show exactly where in the code the vulnerabilities have occurred in the past, and how it was patched (if it is patched).

  • 4
    you could search Github for CVEs in the "issues" section of repos .... – schroeder May 15 '16 at 20:36
  • You can search the CVE database for apps that you know to b3 open source and then look at their source code to find the fixes – Neil Smithline May 16 '16 at 0:53
1

Try this one (https://blogs.securiteam.com/index.php/archives/2543#more-2543), the advisory shows the vulnerable code and since it's an open source product the patch is available from the vendor source code (http://www.live555.com/liveMedia/public/).

1

Check out exploitdb by Offensive Security: https://www.exploit-db.com/

1

Rapid7 is also a great place. You can try to run a granular google search there.

site:https://www.rapid7.com/ "CVE"

Most of the time you'll see great examples of vulnerabilities and threats along with where to find hotfixes for them.

0

As mentioned, exploit-db will have a solid repository of memory corruption bugs sorted by category. But you also asked for fixes; these are usually found on the vendors website under the name 'diffs' (differences)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.