rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: An issue was discovered in the Linux kernel before 5.0.5. There is a use-after-free issue when hci_uart_register_dev() fails in hci_uart_set_proto() in drivers/bluetooth/hci_ldisc.c.
Vulnerability ID: CVE-2019-15917
CWE: CWE-416
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2019-09-04
File: drivers/bluetooth/hci_ldisc.c
Commit message: Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto()

task A:                                task B:
hci_uart_set_proto                     flush_to_ldisc
 - p->open(hu) -> h5_open  //alloc h5  - receive_buf
 - set_bit HCI_UART_PROTO_READY         - tty_port_default_receive_buf
 - hci_uart_register_dev                 - tty_ldisc_receive_buf
                                          - hci_uart_tty_receive
				           - test_bit HCI_UART_PROTO_READY
				            - h5_recv
 - clear_bit HCI_UART_PROTO_READY             while() {
 - p->open(hu) -> h5_close //free h5
				              - h5_rx_3wire_hdr
				               - h5_reset()  //use-after-free
                                              }

It could use ioctl to set hci uart proto, but there is
a use-after-free issue when hci_uart_register_dev() fail in
hci_uart_set_proto(), see stack above, fix this by setting
HCI_UART_PROTO_READY bit only when hci_uart_register_dev()
return success.

Reported-by: syzbot+899a33dc0fa0dbaf06a6@syzkaller.appspotmail.com
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Reviewed-by: Jeremy Cline <jcline@redhat.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Commit author: Kefeng Wang

Vulnerable version (before fix):
 static int hci_uart_set_proto(struct hci_uart *hu, int id) 		return -EPROTONOSUPPORT;  	hu->proto = p; 	set_bit(HCI_UART_PROTO_READY, &hu->flags);  	err = hci_uart_register_dev(hu); 	if (err) { 		clear_bit(HCI_UART_PROTO_READY, &hu->flags); 		return err; 	}  	return 0; } 

Fixed version (after fix):
 static int hci_uart_set_proto(struct hci_uart *hu, int id) 		return -EPROTONOSUPPORT;  	hu->proto = p;  	err = hci_uart_register_dev(hu); 	if (err) { 		return err; 	}  	set_bit(HCI_UART_PROTO_READY, &hu->flags); 	return 0; } 

Patch:
patch: @@ -696,14 +696,13 @@ static int hci_uart_set_proto(struct hci_uart *hu, int id)
 		return -EPROTONOSUPPORT;
 
 	hu->proto = p;
-	set_bit(HCI_UART_PROTO_READY, &hu->flags);
 
 	err = hci_uart_register_dev(hu);
 	if (err) {
-		clear_bit(HCI_UART_PROTO_READY, &hu->flags);
 		return err;
 	}
 
+	set_bit(HCI_UART_PROTO_READY, &hu->flags);
 	return 0;
 }
path: drivers/bluetooth/hci_ldisc.c
Vulnerability: An issue was discovered in the Linux kernel before 5.0.10. SMB2_write in fs/cifs/smb2pdu.c has a use-after-free.
Vulnerability ID: CVE-2019-15919
CWE: CWE-416
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2019-09-04
File: fs/cifs/smb2pdu.c
Commit message: cifs: Fix use-after-free in SMB2_write

There is a KASAN use-after-free:
BUG: KASAN: use-after-free in SMB2_write+0x1342/0x1580
Read of size 8 at addr ffff8880b6a8e450 by task ln/4196

Should not release the 'req' because it will use in the trace.

Fixes: eccb4422cf97 ("smb3: Add ftrace tracepoints for improved SMB3 debugging")

Signed-off-by: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
CC: Stable <stable@vger.kernel.org> 4.18+
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
Commit author: ZhangXiaoxu

Vulnerable version (before fix):
 SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms,  	rc = cifs_send_recv(xid, io_parms->tcon->ses, &rqst, 			    &resp_buftype, flags, &rsp_iov); 	cifs_small_buf_release(req); 	rsp = (struct smb2_write_rsp *)rsp_iov.iov_base;  	if (rc) { SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms, 				     io_parms->offset, *nbytes); 	}  	free_rsp_buf(resp_buftype, rsp); 	return rc; }

Fixed version (after fix):
 SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms,  	rc = cifs_send_recv(xid, io_parms->tcon->ses, &rqst, 			    &resp_buftype, flags, &rsp_iov); 	rsp = (struct smb2_write_rsp *)rsp_iov.iov_base;  	if (rc) { SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms, 				     io_parms->offset, *nbytes); 	}  	cifs_small_buf_release(req); 	free_rsp_buf(resp_buftype, rsp); 	return rc; }

Patch:
patch: @@ -3769,7 +3769,6 @@ SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms,
 
 	rc = cifs_send_recv(xid, io_parms->tcon->ses, &rqst,
 			    &resp_buftype, flags, &rsp_iov);
-	cifs_small_buf_release(req);
 	rsp = (struct smb2_write_rsp *)rsp_iov.iov_base;
 
 	if (rc) {
@@ -3787,6 +3786,7 @@ SMB2_write(const unsigned int xid, struct cifs_io_parms *io_parms,
 				     io_parms->offset, *nbytes);
 	}
 
+	cifs_small_buf_release(req);
 	free_rsp_buf(resp_buftype, rsp);
 	return rc;
 }
path: fs/cifs/smb2pdu.c
Vulnerability: An issue was discovered in the Linux kernel before 5.0.10. SMB2_read in fs/cifs/smb2pdu.c has a use-after-free. NOTE: this was not fixed correctly in 5.0.10; see the 5.0.11 ChangeLog, which documents a memory leak.
Vulnerability ID: CVE-2019-15920
CWE: CWE-416
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2019-09-04
File: fs/cifs/smb2pdu.c
Commit message: cifs: Fix use-after-free in SMB2_read

There is a KASAN use-after-free:
BUG: KASAN: use-after-free in SMB2_read+0x1136/0x1190
Read of size 8 at addr ffff8880b4e45e50 by task ln/1009

Should not release the 'req' because it will use in the trace.

Fixes: eccb4422cf97 ("smb3: Add ftrace tracepoints for improved SMB3 debugging")

Signed-off-by: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
CC: Stable <stable@vger.kernel.org> 4.18+
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
Commit author: ZhangXiaoxu

Vulnerable version (before fix):
 SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms, 	rqst.rq_nvec = 1;  	rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov); 	cifs_small_buf_release(req);  	rsp = (struct smb2_read_rsp *)rsp_iov.iov_base;  	if (rc) { SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms, 				    io_parms->tcon->tid, ses->Suid, 				    io_parms->offset, io_parms->length);  	*nbytes = le32_to_cpu(rsp->DataLength); 	if ((*nbytes > CIFS_MAX_MSGSIZE) || 	    (*nbytes > io_parms->length)) {

Fixed version (after fix):
 SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms, 	rqst.rq_nvec = 1;  	rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov); 	rsp = (struct smb2_read_rsp *)rsp_iov.iov_base;  	if (rc) { SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms, 				    io_parms->tcon->tid, ses->Suid, 				    io_parms->offset, io_parms->length);  	cifs_small_buf_release(req);  	*nbytes = le32_to_cpu(rsp->DataLength); 	if ((*nbytes > CIFS_MAX_MSGSIZE) || 	    (*nbytes > io_parms->length)) {

Patch:
patch: @@ -3448,8 +3448,6 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
 	rqst.rq_nvec = 1;
 
 	rc = cifs_send_recv(xid, ses, &rqst, &resp_buftype, flags, &rsp_iov);
-	cifs_small_buf_release(req);
-
 	rsp = (struct smb2_read_rsp *)rsp_iov.iov_base;
 
 	if (rc) {
@@ -3471,6 +3469,8 @@ SMB2_read(const unsigned int xid, struct cifs_io_parms *io_parms,
 				    io_parms->tcon->tid, ses->Suid,
 				    io_parms->offset, io_parms->length);
 
+	cifs_small_buf_release(req);
+
 	*nbytes = le32_to_cpu(rsp->DataLength);
 	if ((*nbytes > CIFS_MAX_MSGSIZE) ||
 	    (*nbytes > io_parms->length)) {
path: fs/cifs/smb2pdu.c
Vulnerability: An issue was discovered in the Linux kernel before 5.0.6. There is a memory leak issue when idr_alloc() fails in genl_register_family() in net/netlink/genetlink.c.
Vulnerability ID: CVE-2019-15921
CWE: CWE-401
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-09-04
File: net/netlink/genetlink.c
Commit message: genetlink: Fix a memory leak on error path

In genl_register_family(), when idr_alloc() fails,
we forget to free the memory we possibly allocate for
family->attrbuf.

Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: 2ae0f17df1cd ("genetlink: use idr to track families")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: YueHaibing

Vulnerable version (before fix):
 int genl_register_family(struct genl_family *family) 			       start, end + 1, GFP_KERNEL); 	if (family->id < 0) { 		err = family->id; 		goto errout_locked; 	}  	err = genl_validate_assign_mc_groups(family); int genl_register_family(struct genl_family *family)  errout_remove: 	idr_remove(&genl_fam_idr, family->id); 	kfree(family->attrbuf); errout_locked: 	genl_unlock_all();

Fixed version (after fix):
 int genl_register_family(struct genl_family *family) 			       start, end + 1, GFP_KERNEL); 	if (family->id < 0) { 		err = family->id; 		goto errout_free; 	}  	err = genl_validate_assign_mc_groups(family); int genl_register_family(struct genl_family *family)  errout_remove: 	idr_remove(&genl_fam_idr, family->id); errout_free: 	kfree(family->attrbuf); errout_locked: 	genl_unlock_all();

Patch:
patch: @@ -366,7 +366,7 @@ int genl_register_family(struct genl_family *family)
 			       start, end + 1, GFP_KERNEL);
 	if (family->id < 0) {
 		err = family->id;
-		goto errout_locked;
+		goto errout_free;
 	}
 
 	err = genl_validate_assign_mc_groups(family);
@@ -385,6 +385,7 @@ int genl_register_family(struct genl_family *family)
 
 errout_remove:
 	idr_remove(&genl_fam_idr, family->id);
+errout_free:
 	kfree(family->attrbuf);
 errout_locked:
 	genl_unlock_all();
path: net/netlink/genetlink.c
Vulnerability: OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c.
Vulnerability ID: CVE-2019-15945
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/OpenSC/OpenSC
Published: 2019-09-05
File: src/libopensc/asn1.c
Commit message: fixed out of bounds access of ASN.1 Bitstring

Credit to OSS-Fuzz
Commit author: Frank Morgner

Vulnerable version (before fix):
 static int decode_bit_string(const u8 * inbuf, size_t inlen, void *outbuf, { 	const u8 *in = inbuf; 	u8 *out = (u8 *) outbuf; 	int zero_bits = *in & 0x07; 	size_t octets_left = inlen - 1; 	int i, count = 0;  	memset(outbuf, 0, outlen); 	in++; 	if (outlen < octets_left) 		return SC_ERROR_BUFFER_TOO_SMALL; 	if (inlen < 1) 		return SC_ERROR_INVALID_ASN1_OBJECT; 	while (octets_left) { 		/* 1st octet of input:  ABCDEFGH, where A is the MSB */ 		/* 1st octet of output: HGFEDCBA, where A is the LSB */

Fixed version (after fix):
 static int decode_bit_string(const u8 * inbuf, size_t inlen, void *outbuf, { 	const u8 *in = inbuf; 	u8 *out = (u8 *) outbuf; 	int i, count = 0; 	int zero_bits; 	size_t octets_left;  	if (outlen < octets_left) 		return SC_ERROR_BUFFER_TOO_SMALL; 	if (inlen < 1) 		return SC_ERROR_INVALID_ASN1_OBJECT;  	zero_bits = *in & 0x07; 	octets_left = inlen - 1; 	in++; 	memset(outbuf, 0, outlen);  	while (octets_left) { 		/* 1st octet of input:  ABCDEFGH, where A is the MSB */ 		/* 1st octet of output: HGFEDCBA, where A is the LSB */

Patch:
patch: @@ -570,16 +570,20 @@ static int decode_bit_string(const u8 * inbuf, size_t inlen, void *outbuf,
 {
 	const u8 *in = inbuf;
 	u8 *out = (u8 *) outbuf;
-	int zero_bits = *in & 0x07;
-	size_t octets_left = inlen - 1;
 	int i, count = 0;
+	int zero_bits;
+	size_t octets_left;
 
-	memset(outbuf, 0, outlen);
-	in++;
 	if (outlen < octets_left)
 		return SC_ERROR_BUFFER_TOO_SMALL;
 	if (inlen < 1)
 		return SC_ERROR_INVALID_ASN1_OBJECT;
+
+	zero_bits = *in & 0x07;
+	octets_left = inlen - 1;
+	in++;
+	memset(outbuf, 0, outlen);
+
 	while (octets_left) {
 		/* 1st octet of input:  ABCDEFGH, where A is the MSB */
 		/* 1st octet of output: HGFEDCBA, where A is the LSB */
path: src/libopensc/asn1.c
Vulnerability: OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c.
Vulnerability ID: CVE-2019-15946
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/OpenSC/OpenSC
Published: 2019-09-05
File: src/libopensc/asn1.c
Commit message: Fixed out of bounds access in ASN.1 Octet string

Credit to OSS-Fuzz
Commit author: Frank Morgner

Vulnerable version (before fix):
 static int asn1_decode_entry(sc_context_t *ctx,struct sc_asn1_entry *entry,  			/* Strip off padding zero */ 			if ((entry->flags & SC_ASN1_UNSIGNED) 			 && obj[0] == 0x00 && objlen > 1) { 				objlen--; 				obj++; 			}

Fixed version (after fix):
 static int asn1_decode_entry(sc_context_t *ctx,struct sc_asn1_entry *entry,  			/* Strip off padding zero */ 			if ((entry->flags & SC_ASN1_UNSIGNED) 					&& objlen > 1 && obj[0] == 0x00) { 				objlen--; 				obj++; 			}

Patch:
patch: @@ -1469,7 +1469,7 @@ static int asn1_decode_entry(sc_context_t *ctx,struct sc_asn1_entry *entry,
 
 			/* Strip off padding zero */
 			if ((entry->flags & SC_ASN1_UNSIGNED)
-			 && obj[0] == 0x00 && objlen > 1) {
+					&& objlen > 1 && obj[0] == 0x00) {
 				objlen--;
 				obj++;
 			}
path: src/libopensc/asn1.c
Vulnerability: LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. The attack uses a survey group in which the title contains JavaScript that is mishandled upon group deletion.
Vulnerability ID: CVE-2019-16172
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/LimeSurvey/LimeSurvey
Published: 2019-09-09
File: application/controllers/admin/SurveysGroupsController.php
Commit message: Fixed issue: [security] #15204: Stored XSS vulnerabilities - Thanks to J. Greil from the SEC Consult Vulnerability Lab (https://www.sec-consult.com)
Dev: encode group name in alert deleted
Commit author: Denis Chenu

Vulnerable version (before fix):
 public function delete($id)              // if AJAX request (triggered by deletion via admin grid view), we should not redirect the browser             if (!isset($_GET['ajax'])) {                 Yii::app()->setFlashMessage(sprintf(gT("The survey group '%s' was deleted."), $sGroupTitle), 'success');                 $this->getController()->redirect(isset($_POST['returnUrl']) ? $_POST['returnUrl'] : array('admin/survey/sa/listsurveys '));             }         }

Fixed version (after fix):
 public function delete($id)              // if AJAX request (triggered by deletion via admin grid view), we should not redirect the browser             if (!isset($_GET['ajax'])) {                 Yii::app()->setFlashMessage(sprintf(gT("The survey group '%s' was deleted."), CHtml::encode($sGroupTitle)), 'success');                 $this->getController()->redirect(isset($_POST['returnUrl']) ? $_POST['returnUrl'] : array('admin/survey/sa/listsurveys '));             }         }

Patch:
patch: @@ -130,7 +130,7 @@ public function delete($id)
 
             // if AJAX request (triggered by deletion via admin grid view), we should not redirect the browser
             if (!isset($_GET['ajax'])) {
-                Yii::app()->setFlashMessage(sprintf(gT("The survey group '%s' was deleted."), $sGroupTitle), 'success');
+                Yii::app()->setFlashMessage(sprintf(gT("The survey group '%s' was deleted."), CHtml::encode($sGroupTitle)), 'success');
                 $this->getController()->redirect(isset($_POST['returnUrl']) ? $_POST['returnUrl'] : array('admin/survey/sa/listsurveys '));
             }
         }
path: application/controllers/admin/SurveysGroupsController.php
Vulnerability: The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could send a crafted message causing the server to spend an effectively arbitrary amount of CPU time and stall the processing of future messages.
Vulnerability ID: CVE-2019-16215
CWE: CWE-400
Severity score: 2.9
Project: https://github.com/zulip/zulip
Published: 2019-09-18
File: zerver/lib/bugdown/__init__.py
Commit message: CVE-2019-16215: Fix DoS vulnerability in Markdown LINK_RE.

Any regex including a match-everything subpattern (.*, .*?, .+, or
.+?) is almost automatically wrong because it fails to disambiguate
when one subpattern should end and another should begin.  Among other
bugs, these kind of regexes tend to be especially prone to denial of
service vulnerabilities through catastrophic backtracking on strings
that fail to match in a large (in this case, exponential) number of
ways.

Lacking a specification to say what characters should actually be
allowed in these subpatterns (this syntax is too different from
CommonMark to be able to precisely apply those rules), I’ve tried to
make reasonable guesses and avoid changing much else.

Because Zulip doesn't store messages until they have successfully been
processed by the Markdown processor, this is not a stored DoS issue.

In general, Zulip protects against the broad category of DoS issues in
Markdown rendering via a timeout managed by another thread.  However,
details of Python's regular expression implementation mean that this
particular issue could prevent the timeout thread from being
scheduled, resulting in this being a DoS issue.

This was fixed in master a few months ago as a side effect of
abe2dab88ca96786bb32dea6caab873819b8c482 (#12979).

Signed-off-by: Anders Kaseorg <anders@zulipchat.com>
Commit author: Anders Kaseorg

Vulnerable version (before fix):
 def get_link_re() -> str:      # [text](url) or [text](<url>) or [text](url "title")     LINK_RE = NOIMG + BRK + \         r'''\(\s*(<.*?>|((?:(?:\(.*?\))|[^\(\)]))*?)\s*((['"])(.*?)\12\s*)?\)'''     return normal_compile(LINK_RE)  def prepare_realm_pattern(source: str) -> str:

Fixed version (after fix):
 def get_link_re() -> str:      # [text](url) or [text](<url>) or [text](url "title")     LINK_RE = NOIMG + BRK + \         r'''\(\s*(<(?:[^<>\\]|\\.)*>|(\([^()]*\)|[^()])*?)\s*(('(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*")\s*)?\)'''     return normal_compile(LINK_RE)  def prepare_realm_pattern(source: str) -> str:

Patch:
patch: @@ -1484,7 +1484,7 @@ def get_link_re() -> str:
 
     # [text](url) or [text](<url>) or [text](url "title")
     LINK_RE = NOIMG + BRK + \
-        r'''\(\s*(<.*?>|((?:(?:\(.*?\))|[^\(\)]))*?)\s*((['"])(.*?)\12\s*)?\)'''
+        r'''\(\s*(<(?:[^<>\\]|\\.)*>|(\([^()]*\)|[^()])*?)\s*(('(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*")\s*)?\)'''
     return normal_compile(LINK_RE)
 
 def prepare_realm_pattern(source: str) -> str:
path: zerver/lib/bugdown/__init__.py
Vulnerability: In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2019-10867 and CVE-2019-16317.
Vulnerability ID: CVE-2019-16318
CWE: CWE-434
Severity score: 6.4
Project: https://github.com/pimcore/pimcore
Published: 2019-09-14
File: models/Asset.php
Commit message: [Asset] do not allow filenames longer than 255 characters
Commit author: Bernhard Rusch

Vulnerable version (before fix):
 public function correctPath()             $this->setFilename($this->getFilename() . '.txt');         }          if (Asset\Service::pathExists($this->getRealFullPath())) {             $duplicate = Asset::getByPath($this->getRealFullPath());             if ($duplicate instanceof Asset and $duplicate->getId() != $this->getId()) {

Fixed version (after fix):
 public function correctPath()             $this->setFilename($this->getFilename() . '.txt');         }          if(mb_strlen($this->getFilename()) > 255) {             throw new \Exception('Filenames longer than 255 characters are not allowed');         }          if (Asset\Service::pathExists($this->getRealFullPath())) {             $duplicate = Asset::getByPath($this->getRealFullPath());             if ($duplicate instanceof Asset and $duplicate->getId() != $this->getId()) {

Patch:
patch: @@ -623,6 +623,10 @@ public function correctPath()
             $this->setFilename($this->getFilename() . '.txt');
         }
 
+        if(mb_strlen($this->getFilename()) > 255) {
+            throw new \Exception('Filenames longer than 255 characters are not allowed');
+        }
+
         if (Asset\Service::pathExists($this->getRealFullPath())) {
             $duplicate = Asset::getByPath($this->getRealFullPath());
             if ($duplicate instanceof Asset and $duplicate->getId() != $this->getId()) {
path: models/Asset.php
Vulnerability: An XSS issue was discovered in pfSense through 2.4.4-p3. In services_captiveportal_mac.php, the username and delmac parameters are displayed without sanitization.
Vulnerability ID: CVE-2019-16914
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/pfsense/pfsense
Published: 2019-09-26
File: src/usr/local/www/services_captiveportal_mac.php
Commit message: Encode error output in services_captiveportal_mac.php. Fixes #9609
Commit author: jim-p

Vulnerable version (before fix):
 			if (!empty($mac)) { 				$_POST['delmac'] = $mac['mac']; 			} else { 				echo gettext("No entry exists for this username:") . " " . $_POST['username'] . "\n"; 			} 		}  				write_config(); 				echo gettext("The entry was successfully deleted") . "\n"; 			} else { 				echo gettext("No entry exists for this mac address:") . " " . $_POST['delmac'] . "\n"; 			} 		} 		exit;

Fixed version (after fix):
 			if (!empty($mac)) { 				$_POST['delmac'] = $mac['mac']; 			} else { 				echo gettext("No entry exists for this username:") . " " . htmlspecialchars($_POST['username']) . "\n"; 			} 		}  				write_config(); 				echo gettext("The entry was successfully deleted") . "\n"; 			} else { 				echo gettext("No entry exists for this mac address:") . " " . htmlspecialchars($_POST['delmac']) . "\n"; 			} 		} 		exit;

Patch:
patch: @@ -89,7 +89,7 @@
 			if (!empty($mac)) {
 				$_POST['delmac'] = $mac['mac'];
 			} else {
-				echo gettext("No entry exists for this username:") . " " . $_POST['username'] . "\n";
+				echo gettext("No entry exists for this username:") . " " . htmlspecialchars($_POST['username']) . "\n";
 			}
 		}
 
@@ -112,7 +112,7 @@
 				write_config();
 				echo gettext("The entry was successfully deleted") . "\n";
 			} else {
-				echo gettext("No entry exists for this mac address:") . " " . $_POST['delmac'] . "\n";
+				echo gettext("No entry exists for this mac address:") . " " . htmlspecialchars($_POST['delmac']) . "\n";
 			}
 		}
 		exit;
path: src/usr/local/www/services_captiveportal_mac.php