CVE-2016-5834: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link function in wp-includes/post-template.php in WordPress before 4.5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted attachment name, a different vulnerability than CVE-2016-5833.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2016-06-29T14:10Z
Repository: https://github.com/WordPress/WordPress
Language: PHP
Files changed: wp-admin/includes/class-wp-media-list-table.php, wp-includes/post-template.php, wp-includes/version.php
Commit date: 2016-06-21 14:20:55 +0000
Commit message: Admin: Escape attachment name in case it contains special characters

Built from https://develop.svn.wordpress.org/trunk@37774


git-svn-id: http://core.svn.wordpress.org/trunk@37739 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Diff: diff --git a/wp-admin/includes/class-wp-media-list-table.php b/wp-admin/includes/class-wp-media-list-table.php
index 3a61f159b..d7b17c568 100644
--- a/wp-admin/includes/class-wp-media-list-table.php
+++ b/wp-admin/includes/class-wp-media-list-table.php
@@ -393,11 +393,11 @@ class WP_Media_List_Table extends WP_List_Table {
 		</strong>
 		<p class="filename">
 			<span class="screen-reader-text"><?php _e( 'File name:' ); ?> </span>
 			<?php
 			$file = get_attached_file( $post->ID );
-			echo wp_basename( $file );
+			echo esc_html( wp_basename( $file ) );
 			?>
 		</p>
 		<?php
 	}
 
diff --git a/wp-includes/post-template.php b/wp-includes/post-template.php
index 6ddc4b34e..dd83095fc 100644
--- a/wp-includes/post-template.php
+++ b/wp-includes/post-template.php
@@ -1473,11 +1473,11 @@ function wp_get_attachment_link( $id = 0, $size = 'thumbnail', $permalink = fals
 	 *                                Default 'thumbnail'.
 	 * @param bool         $permalink Whether to add permalink to image. Default false.
 	 * @param bool         $icon      Whether to include an icon. Default false.
 	 * @param string|bool  $text      If string, will be link text. Default false.
 	 */
-	return apply_filters( 'wp_get_attachment_link', "<a href='$url'>$link_text</a>", $id, $size, $permalink, $icon, $text );
+	return apply_filters( 'wp_get_attachment_link', "<a href='" . esc_url( $url ) . "'>$link_text</a>", $id, $size, $permalink, $icon, $text );
 }
 
 /**
  * Wrap attachment in paragraph tag before content.
  *
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 76bd3c213..92fdf8d58 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -2,11 +2,11 @@
 /**
  * The WordPress version string
  *
  * @global string $wp_version
  */
-$wp_version = '4.6-alpha-37756';
+$wp_version = '4.6-alpha-37774';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
  *
  * @global int $wp_db_version

Vulnerable code: 			echo wp_basename( $file );
	return apply_filters( 'wp_get_attachment_link', "<a href='$url'>$link_text</a>", $id, $size, $permalink, $icon, $text );
$wp_version = '4.6-alpha-37756';
Fixed code: 			echo esc_html( wp_basename( $file ) );
	return apply_filters( 'wp_get_attachment_link', "<a href='" . esc_url( $url ) . "'>$link_text</a>", $id, $size, $permalink, $icon, $text );
$wp_version = '4.6-alpha-37774';