rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The access_has_bug_level function in core/access_api.php in MantisBT before 1.2.9 does not properly restrict access when the private_bug_view_threshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports.
Vulnerability ID: CVE-2012-1118
CWE: CWE-264
Severity score: 2.9
Project: https://github.com/mantisbt/mantisbt
Published: 2012-06-29
File: core/access_api.php
Commit message: Fix bug in access_has_bug_level() for private issues

When private_bug_threshold is defined as an array instead of a single
access level, e.g. array(0=>40, 1=>70, 2=>90) to prevent developers
from seeing private bugs while granting that privilege to updaters,
access_has_bug_level() incorrectly returned true.

The consequence is that unwanted access to Private bugs was granted to
users who are allowed to view them, e.g. allowing them to delete or
perform other restricted actions.

Fixes #10124
Commit author: Damien Regad

Vulnerable version (before fix):
 function access_has_bug_level( $p_access_level, $p_bug_id, $p_user_id = null ) { 		return false; 	}  	# If the bug is private and the user is not the reporter, then the 	#  the user must also have higher access than private_bug_threshold 	if( VS_PRIVATE == bug_get_field( $p_bug_id, 'view_state' ) && !bug_is_user_reporter( $p_bug_id, $p_user_id ) ) { 		$p_access_level = max( $p_access_level, config_get( 'private_bug_threshold' ) ); 	}  	return access_has_project_level( $p_access_level, $t_project_id, $p_user_id );

Fixed version (after fix):
 function access_has_bug_level( $p_access_level, $p_bug_id, $p_user_id = null ) { 		return false; 	}  	# If the bug is private and the user is not the reporter, then 	# they must also have higher access than private_bug_threshold 	if( VS_PRIVATE == bug_get_field( $p_bug_id, 'view_state' ) && !bug_is_user_reporter( $p_bug_id, $p_user_id ) ) { 		$t_access_level = access_get_project_level( $t_project_id, $p_user_id ); 		return access_compare_level( $t_access_level, config_get( 'private_bug_threshold' ) ) 		    && access_compare_level( $t_access_level, $p_access_level ); 	}  	return access_has_project_level( $p_access_level, $t_project_id, $p_user_id );

Patch:
patch: @@ -420,10 +420,12 @@ function access_has_bug_level( $p_access_level, $p_bug_id, $p_user_id = null ) {
 		return false;
 	}
 
-	# If the bug is private and the user is not the reporter, then the
-	#  the user must also have higher access than private_bug_threshold
+	# If the bug is private and the user is not the reporter, then
+	# they must also have higher access than private_bug_threshold
 	if( VS_PRIVATE == bug_get_field( $p_bug_id, 'view_state' ) && !bug_is_user_reporter( $p_bug_id, $p_user_id ) ) {
-		$p_access_level = max( $p_access_level, config_get( 'private_bug_threshold' ) );
+		$t_access_level = access_get_project_level( $t_project_id, $p_user_id );
+		return access_compare_level( $t_access_level, config_get( 'private_bug_threshold' ) )
+		    && access_compare_level( $t_access_level, $p_access_level );
 	}
 
 	return access_has_project_level( $p_access_level, $t_project_id, $p_user_id );
path: core/access_api.php
Vulnerability: The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnote_allow_user_edit_delete and delete_bug_threshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes.
Vulnerability ID: CVE-2012-1120
CWE: CWE-264
Severity score: 4.9
Project: https://github.com/mantisbt/mantisbt
Published: 2012-06-29
File: api/soap/mc_issue_api.php
Commit message: SOAP API: proper access checks when deleting bugs

Affects #13656 : Reporters have read/write access to existing data of other users
Commit author: Robert Munteanu

Vulnerable version (before fix):
 function mc_issue_delete( $p_username, $p_password, $p_issue_id ) { 	if( !mci_has_readwrite_access( $t_user_id, $t_project_id ) ) { 		return mci_soap_fault_access_denied( $t_user_id ); 	}  	return bug_delete( $p_issue_id ); }

Fixed version (after fix):
 function mc_issue_delete( $p_username, $p_password, $p_issue_id ) { 	if( !mci_has_readwrite_access( $t_user_id, $t_project_id ) ) { 		return mci_soap_fault_access_denied( $t_user_id ); 	} 	 	if ( !access_has_bug_level( config_get( 'delete_bug_threshold' ), $p_issue_id, $t_user_id ) ) { 	    return mci_soap_fault_access_denied( $t_user_id ); 	}  	return bug_delete( $p_issue_id ); }

Patch:
patch: @@ -943,6 +943,10 @@ function mc_issue_delete( $p_username, $p_password, $p_issue_id ) {
 	if( !mci_has_readwrite_access( $t_user_id, $t_project_id ) ) {
 		return mci_soap_fault_access_denied( $t_user_id );
 	}
+	
+	if ( !access_has_bug_level( config_get( 'delete_bug_threshold' ), $p_issue_id, $t_user_id ) ) {
+	    return mci_soap_fault_access_denied( $t_user_id );
+	}
 
 	return bug_delete( $p_issue_id );
 }
path: api/soap/mc_issue_api.php
Vulnerability: bug_actiongroup.php in MantisBT before 1.2.9 does not properly check the report_bug_threshold permission of the receiving project when moving a bug report, which allows remote authenticated users with the report_bug_threshold and move_bug_threshold privileges for a project to bypass intended access restrictions and move bug reports to a different project.
Vulnerability ID: CVE-2012-1122
CWE: CWE-264
Severity score: 4.9
Project: https://github.com/mantisbt/mantisbt
Published: 2012-06-29
File: bug_actiongroup.php
Commit message: Fix Move bugs from projects with access < report_bug_threshold

The access check in bug_actiongroup.php was not correct. It should
verify the user's report_bug_threshold in the target project, not the
current project.

Fixes #13748
Commit author: Damien Regad

Vulnerable version (before fix):
  	case 'MOVE': 		$f_project_id = gpc_get_int( 'project_id' ); 		if ( access_has_bug_level( config_get( 'move_bug_threshold' ), $t_bug_id ) && 		     access_has_project_level( config_get( 'report_bug_threshold' ), $f_project_id ) ) { 			/** @todo we need to issue a helper_call_custom_function( 'issue_update_validate', array( $t_bug_id, $t_bug_data, $f_bugnote_text ) ); */ 			bug_move( $t_bug_id, $f_project_id ); 			helper_call_custom_function( 'issue_update_notify', array( $t_bug_id ) );

Fixed version (after fix):
  	case 'MOVE': 		$f_project_id = gpc_get_int( 'project_id' ); 		if( access_has_bug_level( config_get( 'move_bug_threshold' ), $t_bug_id ) && 		    access_has_project_level( config_get( 'report_bug_threshold', null, null, $f_project_id ), $f_project_id ) ) { 			/** @todo we need to issue a helper_call_custom_function( 'issue_update_validate', array( $t_bug_id, $t_bug_data, $f_bugnote_text ) ); */ 			bug_move( $t_bug_id, $f_project_id ); 			helper_call_custom_function( 'issue_update_notify', array( $t_bug_id ) );

Patch:
patch: @@ -136,8 +136,8 @@
 
 	case 'MOVE':
 		$f_project_id = gpc_get_int( 'project_id' );
-		if ( access_has_bug_level( config_get( 'move_bug_threshold' ), $t_bug_id ) &&
-		     access_has_project_level( config_get( 'report_bug_threshold' ), $f_project_id ) ) {
+		if( access_has_bug_level( config_get( 'move_bug_threshold' ), $t_bug_id ) &&
+		    access_has_project_level( config_get( 'report_bug_threshold', null, null, $f_project_id ), $f_project_id ) ) {
 			/** @todo we need to issue a helper_call_custom_function( 'issue_update_validate', array( $t_bug_id, $t_bug_data, $f_bugnote_text ) ); */
 			bug_move( $t_bug_id, $f_project_id );
 			helper_call_custom_function( 'issue_update_notify', array( $t_bug_id ) );
path: bug_actiongroup.php
Vulnerability: The mci_check_login function in api/soap/mc_api.php in the SOAP API in MantisBT before 1.2.9 allows remote attackers to bypass authentication via a null password.
Vulnerability ID: CVE-2012-1123
CWE: CWE-287
Severity score: 6.4
Project: https://github.com/mantisbt/mantisbt
Published: 2012-06-29
File: api/soap/mc_api.php
Commit message: Fix 0013901: SOAP API allows invoking methods without proper authentication

Note: only applied to 1.2.x not 'next', as the code is changing anyway
Commit author: root

Vulnerable version (before fix):
 function mci_check_login( $p_username, $p_password ) {  		# do not use password validation. 		$p_password = null; 	}  	if( false === auth_attempt_script_login( $p_username, $p_password ) ) {

Fixed version (after fix):
 function mci_check_login( $p_username, $p_password ) {  		# do not use password validation. 		$p_password = null; 	} else { 		if( is_blank( $p_password ) ) { 			# require password for authenticated access 			return false; 		} 	}  	if( false === auth_attempt_script_login( $p_username, $p_password ) ) {

Patch:
patch: @@ -51,6 +51,11 @@ function mci_check_login( $p_username, $p_password ) {
 
 		# do not use password validation.
 		$p_password = null;
+	} else {
+		if( is_blank( $p_password ) ) {
+			# require password for authenticated access
+			return false;
+		}
 	}
 
 	if( false === auth_attempt_script_login( $p_username, $p_password ) ) {
path: api/soap/mc_api.php
Vulnerability: Cross-site scripting (XSS) vulnerability in the replication-setup functionality in js/replication.js in phpMyAdmin 3.4.x before 3.4.10.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted database name.
Vulnerability ID: CVE-2012-1190
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/phpmyadmin/phpmyadmin
Published: 2012-05-03
File: js/replication.js
Commit message: Do not put database names as html
Commit author: Michal Čihař

Vulnerable version (before fix):
  */  var random_server_id = Math.floor(Math.random() * 10000000); var conf_prefix = "server-id=" + random_server_id + "<br />log-bin=mysql-bin<br />log-error=mysql-bin.err<br />";  function update_config() {     var conf_ignore = "binlog_ignore_db="; function update_config() {     });      if ($('#db_select option:selected').size() == 0) {         $('#rep').html(conf_prefix);     } else if ($('#db_type option:selected').val() == 'all') {         $('#rep').html(conf_prefix + conf_ignore + database_list);     } else {         $('#rep').html(conf_prefix + conf_do + database_list);     } }  $(document).ready(function() {     $('#rep').html(conf_prefix);     $('#db_type').change(update_config);     $('#db_select').change(update_config); 

Fixed version (after fix):
  */  var random_server_id = Math.floor(Math.random() * 10000000); var conf_prefix = "server-id=" + random_server_id + "\nlog-bin=mysql-bin\nlog-error=mysql-bin.err\n";  function update_config() {     var conf_ignore = "binlog_ignore_db="; function update_config() {     });      if ($('#db_select option:selected').size() == 0) {         $('#rep').text(conf_prefix);     } else if ($('#db_type option:selected').val() == 'all') {         $('#rep').text(conf_prefix + conf_ignore + database_list);     } else {         $('#rep').text(conf_prefix + conf_do + database_list);     } }  $(document).ready(function() {     $('#rep').text(conf_prefix);     $('#db_type').change(update_config);     $('#db_select').change(update_config); 

Patch:
patch: @@ -5,7 +5,7 @@
  */
 
 var random_server_id = Math.floor(Math.random() * 10000000);
-var conf_prefix = "server-id=" + random_server_id + "<br />log-bin=mysql-bin<br />log-error=mysql-bin.err<br />";
+var conf_prefix = "server-id=" + random_server_id + "\nlog-bin=mysql-bin\nlog-error=mysql-bin.err\n";
 
 function update_config() {
     var conf_ignore = "binlog_ignore_db=";
@@ -16,16 +16,16 @@ function update_config() {
     });
 
     if ($('#db_select option:selected').size() == 0) {
-        $('#rep').html(conf_prefix);
+        $('#rep').text(conf_prefix);
     } else if ($('#db_type option:selected').val() == 'all') {
-        $('#rep').html(conf_prefix + conf_ignore + database_list);
+        $('#rep').text(conf_prefix + conf_ignore + database_list);
     } else {
-        $('#rep').html(conf_prefix + conf_do + database_list);
+        $('#rep').text(conf_prefix + conf_do + database_list);
     }
 }
 
 $(document).ready(function() {
-    $('#rep').html(conf_prefix);
+    $('#rep').text(conf_prefix);
     $('#db_type').change(update_config);
     $('#db_select').change(update_config);
path: js/replication.js
Vulnerability: Directory traversal vulnerability in frontend/core/engine/javascript.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the module parameter to frontend/js.php.
Vulnerability ID: CVE-2012-1207
CWE: CWE-22
Severity score: 2.9
Project: https://github.com/forkcms/forkcms
Published: 2012-02-24
File: frontend/core/engine/javascript.php
Commit message: XSS / LFI Fox
Commit author: Frederik Heyninck

Vulnerable version (before fix):
 private function setLanguage($value) 	 */ 	private function setModule($value) 	{ 		$this->module = (string) $value; 	} }

Fixed version (after fix):
 private function setLanguage($value) 	 */ 	private function setModule($value) 	{ 		$modules = (array) FrontendModel::getModules(); 		 		if(!in_array((string) $value, $modules)) 		{ 			// when debug is on throw an exception 			if(SPOON_DEBUG) throw new FrontendException('Invalid file.');  			// when debug is of show a descent message 			else exit(SPOON_DEBUG_MESSAGE); 		} 		 		$this->module = (string) $value; 	} }

Patch:
patch: @@ -194,6 +194,17 @@ private function setLanguage($value)
 	 */
 	private function setModule($value)
 	{
+		$modules = (array) FrontendModel::getModules();
+		
+		if(!in_array((string) $value, $modules))
+		{
+			// when debug is on throw an exception
+			if(SPOON_DEBUG) throw new FrontendException('Invalid file.');
+
+			// when debug is of show a descent message
+			else exit(SPOON_DEBUG_MESSAGE);
+		}
+		
 		$this->module = (string) $value;
 	}
 }
path: frontend/core/engine/javascript.php
Vulnerability: Double free vulnerability in the xfrm6_tunnel_rcv function in net/ipv6/xfrm6_tunnel.c in the Linux kernel before 2.6.22, when the xfrm6_tunnel module is enabled, allows remote attackers to cause a denial of service (panic) via crafted IPv6 packets.
Vulnerability ID: CVE-2012-1583
CWE: CWE-399
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2012-06-16
File: net/ipv6/xfrm6_tunnel.c
Commit message: [IPV6]: Fix slab corruption running ip6sic

From: Eric Sesterhenn <snakebyte@gmx.de>

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Eric Sesterhenn

Vulnerable version (before fix):
 static int xfrm6_tunnel_rcv(struct sk_buff *skb) 	__be32 spi;  	spi = xfrm6_tunnel_spi_lookup((xfrm_address_t *)&iph->saddr); 	return xfrm6_rcv_spi(skb, spi); }  static int xfrm6_tunnel_err(struct sk_buff *skb, struct inet6_skb_parm *opt,

Fixed version (after fix):
 static int xfrm6_tunnel_rcv(struct sk_buff *skb) 	__be32 spi;  	spi = xfrm6_tunnel_spi_lookup((xfrm_address_t *)&iph->saddr); 	return xfrm6_rcv_spi(skb, spi) > 0 ? : 0; }  static int xfrm6_tunnel_err(struct sk_buff *skb, struct inet6_skb_parm *opt,

Patch:
patch: @@ -261,7 +261,7 @@ static int xfrm6_tunnel_rcv(struct sk_buff *skb)
 	__be32 spi;
 
 	spi = xfrm6_tunnel_spi_lookup((xfrm_address_t *)&iph->saddr);
-	return xfrm6_rcv_spi(skb, spi);
+	return xfrm6_rcv_spi(skb, spi) > 0 ? : 0;
 }
 
 static int xfrm6_tunnel_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
path: net/ipv6/xfrm6_tunnel.c
Vulnerability: Integer overflow in the mid function in toolkit/tbytevector.cpp in TagLib 1.7 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a crafted file header field in a media file, which triggers a large memory allocation.
Vulnerability ID: CVE-2012-1584
CWE: CWE-189
Severity score: 2.9
Project: https://github.com/taglib/taglib
Published: 2012-09-06
File: taglib/toolkit/tbytevector.cpp
Commit message: Avoid uint overflow in case the length + index is over UINT_MAX
Commit author: Lukáš Lalinský

Vulnerable version (before fix):
 ByteVector ByteVector::mid(uint index, uint length) const    ConstIterator endIt;    if(length < 0xffffffff && length + index < size())     endIt = d->data.begin() + index + length;   else     endIt = d->data.end();

Fixed version (after fix):
 ByteVector ByteVector::mid(uint index, uint length) const    ConstIterator endIt;    if(length < size() - index)     endIt = d->data.begin() + index + length;   else     endIt = d->data.end();

Patch:
patch: @@ -363,7 +363,7 @@ ByteVector ByteVector::mid(uint index, uint length) const
 
   ConstIterator endIt;
 
-  if(length < 0xffffffff && length + index < size())
+  if(length < size() - index)
     endIt = d->data.begin() + index + length;
   else
     endIt = d->data.end();
path: taglib/toolkit/tbytevector.cpp
Vulnerability: Cross-site scripting (XSS) vulnerability in the textEncode function in classes/ezjscajaxcontent.php in eZ JS Core in eZ Publish before 1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Vulnerability ID: CVE-2012-1597
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/ezsystems/ezjscore
Published: 2012-08-17
File: classes/ezjscajaxcontent.php
Commit message: Fixed #019245: XSS exploit on eZJSCore RUN command
Commit author: André R

Vulnerable version (before fix):
 public static function textEncode( $mix )         if ( is_array( $mix ) )             return implode(',', array_map( array('ezjscAjaxContent', 'textEncode'), array_filter( $mix ) ) );          return $mix;     }      /**

Fixed version (after fix):
 public static function textEncode( $mix )         if ( is_array( $mix ) )             return implode(',', array_map( array('ezjscAjaxContent', 'textEncode'), array_filter( $mix ) ) );          return htmlspecialchars( $mix );     }      /**

Patch:
patch: @@ -127,7 +127,7 @@ public static function textEncode( $mix )
         if ( is_array( $mix ) )
             return implode(',', array_map( array('ezjscAjaxContent', 'textEncode'), array_filter( $mix ) ) );
 
-        return $mix;
+        return htmlspecialchars( $mix );
     }
 
     /**
path: classes/ezjscajaxcontent.php
Vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in functions.php in phpPgAdmin before 5.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) type of a function.
Vulnerability ID: CVE-2012-1600
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/phppgadmin/phppgadmin
Published: 2014-05-14
File: functions.php
Commit message: Fix XSS in function.php, reported by Mateusz Goik.

I'm not sure why the name and the type the functions were not escaped
*on purpose* here. There's no more reason here than in any other place
with other PostgreSQL objects to not escape the name or the type...
Commit author: Jehan-Guillaume (ioguix) de Rorthais

Vulnerable version (before fix):
 function doDefault($msg = '') { 			'function' => array( 				'title' => $lang['strfunction'], 				'field' => field('proproto'), 				'type'  => 'verbatim', 				'url'   => "redirect.php?subject=function&amp;action=properties&amp;{$misc->href}&amp;", 				'vars'  => array('function' => 'proproto', 'function_oid' => 'prooid'), 			), 			'returns' => array( 				'title' => $lang['strreturns'], 				'field' => field('proreturns'), 				'type'  => 'verbatim', 			), 			'owner' => array( 				'title' => $lang['strowner'],

Fixed version (after fix):
 function doDefault($msg = '') { 			'function' => array( 				'title' => $lang['strfunction'], 				'field' => field('proproto'), 				'url'   => "redirect.php?subject=function&amp;action=properties&amp;{$misc->href}&amp;", 				'vars'  => array('function' => 'proproto', 'function_oid' => 'prooid'), 			), 			'returns' => array( 				'title' => $lang['strreturns'], 				'field' => field('proreturns'), 			), 			'owner' => array( 				'title' => $lang['strowner'],

Patch:
patch: @@ -773,14 +773,12 @@ function doDefault($msg = '') {
 			'function' => array(
 				'title' => $lang['strfunction'],
 				'field' => field('proproto'),
-				'type'  => 'verbatim',
 				'url'   => "redirect.php?subject=function&amp;action=properties&amp;{$misc->href}&amp;",
 				'vars'  => array('function' => 'proproto', 'function_oid' => 'prooid'),
 			),
 			'returns' => array(
 				'title' => $lang['strreturns'],
 				'field' => field('proreturns'),
-				'type'  => 'verbatim',
 			),
 			'owner' => array(
 				'title' => $lang['strowner'],
path: functions.php
Vulnerability: Cross-site scripting (XSS) vulnerability in the refresh mechanism in the log viewer in horizon/static/horizon/js/horizon.js in OpenStack Dashboard (Horizon) folsom-1 and 2012.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the guest console.
Vulnerability ID: CVE-2012-2094
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/openstack/horizon
Published: 2012-06-05
File: horizon/static/horizon/js/horizon.js
Commit message: html escape the console log in refresh

fixes bug 977944

(cherry picked from commit ab2e27522aaeb0268fcc121bd3eff5a4485f313c)

Change-Id: Ic6135ebc58b6c45d6336f0833717086e43d7cccb
Commit author: J. Daniel Schmidt

Vulnerable version (before fix):
 var Horizon = function() {         data: data,         method: 'get',         success: function(response_body) {           $('pre.logs').html(response_body);         },         error: function(response) {           if(via_user_submit) {

Fixed version (after fix):
 var Horizon = function() {         data: data,         method: 'get',         success: function(response_body) {           $('pre.logs').text(response_body);         },         error: function(response) {           if(via_user_submit) {

Patch:
patch: @@ -284,7 +284,7 @@ var Horizon = function() {
         data: data,
         method: 'get',
         success: function(response_body) {
-          $('pre.logs').html(response_body);
+          $('pre.logs').text(response_body);
         },
         error: function(response) {
           if(via_user_submit) {
path: horizon/static/horizon/js/horizon.js
Vulnerability: The cap_bprm_set_creds function in security/commoncap.c in the Linux kernel before 3.3.3 does not properly handle the use of file system capabilities (aka fcaps) for implementing a privileged executable file, which allows local users to bypass intended personality restrictions via a crafted application, as demonstrated by an attack that uses a parent process to disable ASLR.
Vulnerability ID: CVE-2012-2123
CWE: CWE-264
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2012-05-17
File: security/commoncap.c
Commit message: fcaps: clear the same personality flags as suid when fcaps are used

If a process increases permissions using fcaps all of the dangerous
personality flags which are cleared for suid apps should also be cleared.
Thus programs given priviledge with fcaps will continue to have address space
randomization enabled even if the parent tried to disable it to make it
easier to attack.

Signed-off-by: Eric Paris <eparis@redhat.com>
Reviewed-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Commit author: Eric Paris

Vulnerable version (before fix):
 int cap_bprm_set_creds(struct linux_binprm *bprm) 	} skip:  	/* Don't let someone trace a set[ug]id/setpcap binary with the revised 	 * credentials unless they have the appropriate permit 	 */

Fixed version (after fix):
 int cap_bprm_set_creds(struct linux_binprm *bprm) 	} skip:  	/* if we have fs caps, clear dangerous personality flags */ 	if (!cap_issubset(new->cap_permitted, old->cap_permitted)) 		bprm->per_clear |= PER_CLEAR_ON_SETID;   	/* Don't let someone trace a set[ug]id/setpcap binary with the revised 	 * credentials unless they have the appropriate permit 	 */

Patch:
patch: @@ -505,6 +505,11 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
 	}
 skip:
 
+	/* if we have fs caps, clear dangerous personality flags */
+	if (!cap_issubset(new->cap_permitted, old->cap_permitted))
+		bprm->per_clear |= PER_CLEAR_ON_SETID;
+
+
 	/* Don't let someone trace a set[ug]id/setpcap binary with the revised
 	 * credentials unless they have the appropriate permit
 	 */
path: security/commoncap.c