rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The scm_check_creds function in net/core/scm.c in the Linux kernel before 3.8.6 does not properly enforce capability requirements for controlling the PID value associated with a UNIX domain socket, which allows local users to bypass intended access restrictions by leveraging the time interval during which a user namespace has been created but a PID namespace has not been created.
Vulnerability ID: CVE-2013-1958
CWE: CWE-264
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2013-04-24
File: net/core/scm.c
Commit message: scm: Require CAP_SYS_ADMIN over the current pidns to spoof pids.

Don't allow spoofing pids over unix domain sockets in the corner
cases where a user has created a user namespace but has not yet
created a pid namespace.

Cc: stable@vger.kernel.org
Reported-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Commit author: Eric W. Biederman

Vulnerable version (before fix):
 #include <linux/interrupt.h> #include <linux/netdevice.h> #include <linux/security.h> #include <linux/pid.h> #include <linux/nsproxy.h> #include <linux/slab.h> static __inline__ int scm_check_creds(struct ucred *creds) 	if (!uid_valid(uid) || !gid_valid(gid)) 		return -EINVAL;  	if ((creds->pid == task_tgid_vnr(current) || nsown_capable(CAP_SYS_ADMIN)) && 	    ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) || 	      uid_eq(uid, cred->suid)) || nsown_capable(CAP_SETUID)) && 	    ((gid_eq(gid, cred->gid)   || gid_eq(gid, cred->egid) ||

Fixed version (after fix):
 #include <linux/interrupt.h> #include <linux/netdevice.h> #include <linux/security.h> #include <linux/pid_namespace.h> #include <linux/pid.h> #include <linux/nsproxy.h> #include <linux/slab.h> static __inline__ int scm_check_creds(struct ucred *creds) 	if (!uid_valid(uid) || !gid_valid(gid)) 		return -EINVAL;  	if ((creds->pid == task_tgid_vnr(current) || 	     ns_capable(current->nsproxy->pid_ns->user_ns, CAP_SYS_ADMIN)) && 	    ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) || 	      uid_eq(uid, cred->suid)) || nsown_capable(CAP_SETUID)) && 	    ((gid_eq(gid, cred->gid)   || gid_eq(gid, cred->egid) ||

Patch:
patch: @@ -24,6 +24,7 @@
 #include <linux/interrupt.h>
 #include <linux/netdevice.h>
 #include <linux/security.h>
+#include <linux/pid_namespace.h>
 #include <linux/pid.h>
 #include <linux/nsproxy.h>
 #include <linux/slab.h>
@@ -52,7 +53,8 @@ static __inline__ int scm_check_creds(struct ucred *creds)
 	if (!uid_valid(uid) || !gid_valid(gid))
 		return -EINVAL;
 
-	if ((creds->pid == task_tgid_vnr(current) || nsown_capable(CAP_SYS_ADMIN)) &&
+	if ((creds->pid == task_tgid_vnr(current) ||
+	     ns_capable(current->nsproxy->pid_ns->user_ns, CAP_SYS_ADMIN)) &&
 	    ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) ||
 	      uid_eq(uid, cred->suid)) || nsown_capable(CAP_SETUID)) &&
 	    ((gid_eq(gid, cred->gid)   || gid_eq(gid, cred->egid) ||
path: net/core/scm.c
Vulnerability: The ext4_orphan_del function in fs/ext4/namei.c in the Linux kernel before 3.7.3 does not properly handle orphan-list entries for non-journal filesystems, which allows physically proximate attackers to cause a denial of service (system hang) via a crafted filesystem on removable media, as demonstrated by the e2fsprogs tests/f_orphan_extents_inode/image.gz test.
Vulnerability ID: CVE-2013-2015
CWE: CWE-399
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-04-29
File: fs/ext4/namei.c
Commit message: ext4: avoid hang when mounting non-journal filesystems with orphan list

When trying to mount a file system which does not contain a journal,
but which does have a orphan list containing an inode which needs to
be truncated, the mount call with hang forever in
ext4_orphan_cleanup() because ext4_orphan_del() will return
immediately without removing the inode from the orphan list, leading
to an uninterruptible loop in kernel code which will busy out one of
the CPU's on the system.

This can be trivially reproduced by trying to mount the file system
found in tests/f_orphan_extents_inode/image.gz from the e2fsprogs
source tree.  If a malicious user were to put this on a USB stick, and
mount it on a Linux desktop which has automatic mounts enabled, this
could be considered a potential denial of service attack.  (Not a big
deal in practice, but professional paranoids worry about such things,
and have even been known to allocate CVE numbers for such problems.)

Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Reviewed-by: Zheng Liu <wenqing.lz@taobao.com>
Cc: stable@vger.kernel.org
Commit author: Theodore Ts'o

Vulnerable version (before fix):
 int ext4_orphan_del(handle_t *handle, struct inode *inode) 	struct ext4_iloc iloc; 	int err = 0;  	if (!EXT4_SB(inode->i_sb)->s_journal) 		return 0;  	mutex_lock(&EXT4_SB(inode->i_sb)->s_orphan_lock);

Fixed version (after fix):
 int ext4_orphan_del(handle_t *handle, struct inode *inode) 	struct ext4_iloc iloc; 	int err = 0;  	if ((!EXT4_SB(inode->i_sb)->s_journal) && 	    !(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_ORPHAN_FS)) 		return 0;  	mutex_lock(&EXT4_SB(inode->i_sb)->s_orphan_lock);

Patch:
patch: @@ -2648,7 +2648,8 @@ int ext4_orphan_del(handle_t *handle, struct inode *inode)
 	struct ext4_iloc iloc;
 	int err = 0;
 
-	if (!EXT4_SB(inode->i_sb)->s_journal)
+	if ((!EXT4_SB(inode->i_sb)->s_journal) &&
+	    !(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_ORPHAN_FS))
 		return 0;
 
 	mutex_lock(&EXT4_SB(inode->i_sb)->s_orphan_lock);
path: fs/ext4/namei.c
Vulnerability: The host_start function in drivers/usb/chipidea/host.c in the Linux kernel before 3.7.4 does not properly support a certain non-streaming option, which allows local users to cause a denial of service (system crash) by sending a large amount of network traffic through a USB/Ethernet adapter.
Vulnerability ID: CVE-2013-2058
CWE: CWE-119
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-11-04
File: drivers/usb/chipidea/host.c
Commit message: usb: chipidea: Allow disabling streaming not only in udc mode

When running a scp transfer using a USB/Ethernet adapter the following crash
happens:

$ scp test.tar.gz fabio@192.168.1.100:/home/fabio
fabio@192.168.1.100's password:
test.tar.gz                                      0%    0     0.0KB/s   --:-- ETA
------------[ cut here ]------------
WARNING: at net/sched/sch_generic.c:255 dev_watchdog+0x2cc/0x2f0()
NETDEV WATCHDOG: eth0 (asix): transmit queue 0 timed out
Modules linked in:
Backtrace:
[<80011c94>] (dump_backtrace+0x0/0x10c) from [<804d3a5c>] (dump_stack+0x18/0x1c)
 r6:000000ff r5:80412388 r4:80685dc0 r3:80696cc0
[<804d3a44>] (dump_stack+0x0/0x1c) from [<80021868>]
(warn_slowpath_common+0x54/0x6c)
[<80021814>] (warn_slowpath_common+0x0/0x6c) from [<80021924>]
(warn_slowpath_fmt+0x38/0x40)
...

Setting SDIS (Stream Disable Mode- bit 4 of USBMODE register) fixes the problem.

However, in current code CI13XXX_DISABLE_STREAMING flag is only set in udc mode,
so allow disabling streaming also in host mode.

Tested on a mx6qsabrelite board.

Suggested-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Reviewed-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Commit author: Fabio Estevam

Vulnerable version (before fix):
 static int host_start(struct ci13xxx *ci) 	else 		ci->hcd = hcd;  	return ret; } 

Fixed version (after fix):
 static int host_start(struct ci13xxx *ci) 	else 		ci->hcd = hcd;  	if (ci->platdata->flags & CI13XXX_DISABLE_STREAMING) 		hw_write(ci, OP_USBMODE, USBMODE_CI_SDIS, USBMODE_CI_SDIS);  	return ret; } 

Patch:
patch: @@ -70,6 +70,9 @@ static int host_start(struct ci13xxx *ci)
 	else
 		ci->hcd = hcd;
 
+	if (ci->platdata->flags & CI13XXX_DISABLE_STREAMING)
+		hw_write(ci, OP_USBMODE, USBMODE_CI_SDIS, USBMODE_CI_SDIS);
+
 	return ret;
 }
path: drivers/usb/chipidea/host.c
Vulnerability: SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the 'pays' parameter in fiche.php.
Vulnerability ID: CVE-2013-2091
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/Dolibarr/dolibarr
Published: 2019-11-20
File: htdocs/adherents/fiche.php
Commit message: Fix security breach (SQL injection)
Commit author: fhenry

Vulnerable version (before fix):
 function initfieldrequired() 		$adht = new AdherentType($db); 		$adht->fetch($object->typeid);  		// We set country_id, and country_code, country of the chosen country 		if (isset($_POST["pays"]) || $object->country_id) 		{ 			$sql = "SELECT rowid, code, libelle as label from ".MAIN_DB_PREFIX."c_pays where rowid = ".(isset($_POST["pays"])?$_POST["pays"]:$object->country_id); 			$resql=$db->query($sql); 			if ($resql) 			{

Fixed version (after fix):
 function initfieldrequired() 		$adht = new AdherentType($db); 		$adht->fetch($object->typeid);  		$country=GETPOST('pays','int'); 		// We set country_id, and country_code, country of the chosen country 		if (!empty($country) || $object->country_id) 		{ 			$sql = "SELECT rowid, code, libelle as label from ".MAIN_DB_PREFIX."c_pays where rowid = ".(!empty($country)?$country:$object->country_id); 			$resql=$db->query($sql); 			if ($resql) 			{

Patch:
patch: @@ -958,10 +958,11 @@ function initfieldrequired()
 		$adht = new AdherentType($db);
 		$adht->fetch($object->typeid);
 
+		$country=GETPOST('pays','int');
 		// We set country_id, and country_code, country of the chosen country
-		if (isset($_POST["pays"]) || $object->country_id)
+		if (!empty($country) || $object->country_id)
 		{
-			$sql = "SELECT rowid, code, libelle as label from ".MAIN_DB_PREFIX."c_pays where rowid = ".(isset($_POST["pays"])?$_POST["pays"]:$object->country_id);
+			$sql = "SELECT rowid, code, libelle as label from ".MAIN_DB_PREFIX."c_pays where rowid = ".(!empty($country)?$country:$object->country_id);
 			$resql=$db->query($sql);
 			if ($resql)
 			{
path: htdocs/adherents/fiche.php
Vulnerability: Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web script or HTML in functions.lib.php.
Vulnerability ID: CVE-2013-2092
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/Dolibarr/dolibarr
Published: 2019-11-20
File: htdocs/core/lib/functions.lib.php
Commit message: Fix: Escape entities
Commit author: Laurent Destailleur

Vulnerable version (before fix):
 function dol_print_error($db='',$error='') 			$out.="<b>".$langs->trans("PHP").":</b> ".phpversion()."<br>\n"; 			//phpinfo();       // This is to show location of php.ini file 		} 		$out.="<b>".$langs->trans("Server").":</b> ".$_SERVER["SERVER_SOFTWARE"]."<br>\n";; 		$out.="<br>\n"; 		$out.="<b>".$langs->trans("RequestedUrl").":</b> ".$_SERVER["REQUEST_URI"]."<br>\n";; 		$out.="<b>".$langs->trans("Referer").":</b> ".(isset($_SERVER["HTTP_REFERER"])?$_SERVER["HTTP_REFERER"]:'')."<br>\n";; 		$out.="<b>".$langs->trans("MenuManager").":</b> ".$conf->top_menu."<br>\n"; 		$out.="<br>\n"; 		$syslog.="url=".$_SERVER["REQUEST_URI"];

Fixed version (after fix):
 function dol_print_error($db='',$error='') 			$out.="<b>".$langs->trans("PHP").":</b> ".phpversion()."<br>\n"; 			//phpinfo();       // This is to show location of php.ini file 		} 		$out.="<b>".$langs->trans("Server").":</b> ".$_SERVER["SERVER_SOFTWARE"]."<br>\n"; 		$out.="<br>\n"; 		$out.="<b>".$langs->trans("RequestedUrl").":</b> ".dol_htmlentities($_SERVER["REQUEST_URI"],ENT_COMPAT,'UTF-8')."<br>\n"; 		$out.="<b>".$langs->trans("Referer").":</b> ".(isset($_SERVER["HTTP_REFERER"])?dol_htmlentities($_SERVER["HTTP_REFERER"],ENT_COMPAT,'UTF-8'):'')."<br>\n"; 		$out.="<b>".$langs->trans("MenuManager").":</b> ".$conf->top_menu."<br>\n"; 		$out.="<br>\n"; 		$syslog.="url=".$_SERVER["REQUEST_URI"];

Patch:
patch: @@ -2100,10 +2100,10 @@ function dol_print_error($db='',$error='')
 			$out.="<b>".$langs->trans("PHP").":</b> ".phpversion()."<br>\n";
 			//phpinfo();       // This is to show location of php.ini file
 		}
-		$out.="<b>".$langs->trans("Server").":</b> ".$_SERVER["SERVER_SOFTWARE"]."<br>\n";;
+		$out.="<b>".$langs->trans("Server").":</b> ".$_SERVER["SERVER_SOFTWARE"]."<br>\n";
 		$out.="<br>\n";
-		$out.="<b>".$langs->trans("RequestedUrl").":</b> ".$_SERVER["REQUEST_URI"]."<br>\n";;
-		$out.="<b>".$langs->trans("Referer").":</b> ".(isset($_SERVER["HTTP_REFERER"])?$_SERVER["HTTP_REFERER"]:'')."<br>\n";;
+		$out.="<b>".$langs->trans("RequestedUrl").":</b> ".dol_htmlentities($_SERVER["REQUEST_URI"],ENT_COMPAT,'UTF-8')."<br>\n";
+		$out.="<b>".$langs->trans("Referer").":</b> ".(isset($_SERVER["HTTP_REFERER"])?dol_htmlentities($_SERVER["HTTP_REFERER"],ENT_COMPAT,'UTF-8'):'')."<br>\n";
 		$out.="<b>".$langs->trans("MenuManager").":</b> ".$conf->top_menu."<br>\n";
 		$out.="<br>\n";
 		$syslog.="url=".$_SERVER["REQUEST_URI"];
path: htdocs/core/lib/functions.lib.php
Vulnerability: The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.
Vulnerability ID: CVE-2013-2094
CWE: CWE-189
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2013-05-14
File: kernel/events/core.c
Commit message: perf: Treat attr.config as u64 in perf_swevent_init()

Trinity discovered that we fail to check all 64 bits of
attr.config passed by user space, resulting to out-of-bounds
access of the perf_swevent_enabled array in
sw_perf_event_destroy().

Introduced in commit b0a873ebb ("perf: Register PMU
implementations").

Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: davej@redhat.com
Cc: Paul Mackerras <paulus@samba.org>
Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
Link: http://lkml.kernel.org/r/1365882554-30259-1-git-send-email-tt.rantala@gmail.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Commit author: Tommi Rantala

Vulnerable version (before fix):
 static void sw_perf_event_destroy(struct perf_event *event)  static int perf_swevent_init(struct perf_event *event) { 	int event_id = event->attr.config;  	if (event->attr.type != PERF_TYPE_SOFTWARE) 		return -ENOENT;

Fixed version (after fix):
 static void sw_perf_event_destroy(struct perf_event *event)  static int perf_swevent_init(struct perf_event *event) { 	u64 event_id = event->attr.config;  	if (event->attr.type != PERF_TYPE_SOFTWARE) 		return -ENOENT;

Patch:
patch: @@ -5331,7 +5331,7 @@ static void sw_perf_event_destroy(struct perf_event *event)
 
 static int perf_swevent_init(struct perf_event *event)
 {
-	int event_id = event->attr.config;
+	u64 event_id = event->attr.config;
 
 	if (event->attr.type != PERF_TYPE_SOFTWARE)
 		return -ENOENT;
path: kernel/events/core.c
Vulnerability: The tcp_read_sock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage skb consumption, which allows local users to cause a denial of service (system crash) via a crafted splice system call for a TCP socket.
Vulnerability ID: CVE-2013-2128
CWE: CWE-400
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-06-07
File: net/ipv4/tcp.c
Commit message: net: Fix oops from tcp_collapse() when using splice()

tcp_read_sock() can have a eat skbs without immediately advancing copied_seq.
This can cause a panic in tcp_collapse() if it is called as a result
of the recv_actor dropping the socket lock.

A userspace program that splices data from a socket to either another
socket or to a file can trigger this bug.

Signed-off-by: Steven J. Magnani <steve@digidescorp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Steven J. Magnani

Vulnerable version (before fix):
 int tcp_read_sock(struct sock *sk, read_descriptor_t *desc, 		sk_eat_skb(sk, skb, 0); 		if (!desc->count) 			break; 	} 	tp->copied_seq = seq; 

Fixed version (after fix):
 int tcp_read_sock(struct sock *sk, read_descriptor_t *desc, 		sk_eat_skb(sk, skb, 0); 		if (!desc->count) 			break; 		tp->copied_seq = seq; 	} 	tp->copied_seq = seq; 

Patch:
patch: @@ -1368,6 +1368,7 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
 		sk_eat_skb(sk, skb, 0);
 		if (!desc->count)
 			break;
+		tp->copied_seq = seq;
 	}
 	tp->copied_seq = seq;
path: net/ipv4/tcp.c
Vulnerability: The do_tkill function in kernel/signal.c in the Linux kernel before 3.8.9 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted application that makes a (1) tkill or (2) tgkill system call.
Vulnerability ID: CVE-2013-2141
CWE: CWE-399
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2013-06-07
File: kernel/signal.c
Commit message: kernel/signal.c: stop info leak via the tkill and the tgkill syscalls

This fixes a kernel memory contents leak via the tkill and tgkill syscalls
for compat processes.

This is visible in the siginfo_t->_sifields._rt.si_sigval.sival_ptr field
when handling signals delivered from tkill.

The place of the infoleak:

int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from)
{
        ...
        put_user_ex(ptr_to_compat(from->si_ptr), &to->si_ptr);
        ...
}

Signed-off-by: Emese Revfy <re.emese@gmail.com>
Reviewed-by: PaX Team <pageexec@freemail.hu>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Serge Hallyn <serge.hallyn@canonical.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Emese Revfy

Vulnerable version (before fix):
 do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)  static int do_tkill(pid_t tgid, pid_t pid, int sig) { 	struct siginfo info;  	info.si_signo = sig; 	info.si_errno = 0;

Fixed version (after fix):
 do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)  static int do_tkill(pid_t tgid, pid_t pid, int sig) { 	struct siginfo info = {};  	info.si_signo = sig; 	info.si_errno = 0;

Patch:
patch: @@ -2948,7 +2948,7 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
 
 static int do_tkill(pid_t tgid, pid_t pid, int sig)
 {
-	struct siginfo info;
+	struct siginfo info = {};
 
 	info.si_signo = sig;
 	info.si_errno = 0;
path: kernel/signal.c
Vulnerability: The Mandril security plugin in Monkey HTTP Daemon (monkeyd) before 1.5.0 allows remote attackers to bypass access restrictions via a crafted URI, as demonstrated by an encoded forward slash.
Vulnerability ID: CVE-2013-2182
CWE: CWE-264
Severity score: 4.9
Project: https://github.com/monkey/monkey
Published: 2014-06-13
File: plugins/mandril/mandril.c
Commit message: Mandril: check decoded URI (fix #92)

Signed-off-by: Eduardo Silva <eduardo@monkey.io>
Commit author: Eduardo Silva

Vulnerable version (before fix):
 int _mkp_stage_30(struct plugin *p,     (void) cs;      PLUGIN_TRACE("[FD %i] Mandril validating URL", cs->socket);     if (mk_security_check_url(sr->uri) < 0) {         PLUGIN_TRACE("[FD %i] Close connection, blocked URL", cs->socket);         mk_api->header_set_http_status(sr, MK_CLIENT_FORBIDDEN);         return MK_PLUGIN_RET_CLOSE_CONX;

Fixed version (after fix):
 int _mkp_stage_30(struct plugin *p,     (void) cs;      PLUGIN_TRACE("[FD %i] Mandril validating URL", cs->socket);      if (mk_security_check_url(sr->uri_processed) < 0) {         PLUGIN_TRACE("[FD %i] Close connection, blocked URL", cs->socket);         mk_api->header_set_http_status(sr, MK_CLIENT_FORBIDDEN);         return MK_PLUGIN_RET_CLOSE_CONX;

Patch:
patch: @@ -349,7 +349,8 @@ int _mkp_stage_30(struct plugin *p,
     (void) cs;
 
     PLUGIN_TRACE("[FD %i] Mandril validating URL", cs->socket);
-    if (mk_security_check_url(sr->uri) < 0) {
+
+    if (mk_security_check_url(sr->uri_processed) < 0) {
         PLUGIN_TRACE("[FD %i] Close connection, blocked URL", cs->socket);
         mk_api->header_set_http_status(sr, MK_CLIENT_FORBIDDEN);
         return MK_PLUGIN_RET_CLOSE_CONX;
path: plugins/mandril/mandril.c
Vulnerability: Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 and 1.7.x before 1.7.10 allows remote attackers to inject arbitrary web script or HTML via a full name.
Vulnerability ID: CVE-2013-2209
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/reviewboard/reviewboard
Published: 2013-07-31
File: reviewboard/htdocs/media/rb/js/reviews.js
Commit message: Fix an XSS vulnerability in the reviews dropdown.

The reviews dropdown had a bad vulnerability where it would assume the
user's full name is valid HTML. This allowed the user to craft a script
tag that would be executed every time the name appeared in the dropdown.

This vulnerability exists in 1.6.x, 1.7.x, and the in-development 1.8.
There are no known attacks in the wild.

This was reported by Craig Young at Tripwire.
Commit author: Christian Hammond

Vulnerable version (before fix):
 $.fn.reviewsAutoComplete = function(options) {         $(this)             .autocomplete({                 formatItem: function(data) {                     var s = data[options.nameKey];                      if (options.descKey) {                         s += " <span>(" + data[options.descKey] + ")</span>";                     }                      return s;

Fixed version (after fix):
 $.fn.reviewsAutoComplete = function(options) {         $(this)             .autocomplete({                 formatItem: function(data) {                     var s = data[options.nameKey],                         desc;                      if (options.descKey) {                         desc = $('<div/>').text(data[options.descKey]).html();                         s += " <span>(" + desc + ")</span>";                     }                      return s;

Patch:
patch: @@ -352,10 +352,12 @@ $.fn.reviewsAutoComplete = function(options) {
         $(this)
             .autocomplete({
                 formatItem: function(data) {
-                    var s = data[options.nameKey];
+                    var s = data[options.nameKey],
+                        desc;
 
                     if (options.descKey) {
-                        s += " <span>(" + data[options.descKey] + ")</span>";
+                        desc = $('<div/>').text(data[options.descKey]).html();
+                        s += " <span>(" + desc + ")</span>";
                     }
 
                     return s;
path: reviewboard/htdocs/media/rb/js/reviews.js