rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: AP4_AtomFactory::CreateAtomFromStream in Core/Ap4AtomFactory.cpp in Bento4 version 1.5.0-617 has missing NULL checks, leading to a NULL pointer dereference, segmentation fault, and application crash in AP4_Atom::SetType in Core/Ap4Atom.h.
Vulnerability ID: CVE-2017-14638
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/axiomatic-systems/Bento4
Published: 2017-09-21
File: Source/C++/Core/Ap4AtomFactory.cpp
Commit message: fix for #182
Commit author: Gilles Boccon-Gibod

Vulnerable version (before fix):
 AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream& stream,           case AP4_ATOM_TYPE_HVCE:             if (atom_is_large) return AP4_ERROR_INVALID_FORMAT;             atom = AP4_HvccAtom::Create(size_32, stream);             atom->SetType(AP4_ATOM_TYPE_HVCE);             break;            case AP4_ATOM_TYPE_AVCE:             if (atom_is_large) return AP4_ERROR_INVALID_FORMAT;             atom = AP4_AvccAtom::Create(size_32, stream);             atom->SetType(AP4_ATOM_TYPE_AVCE);             break;      #if !defined(AP4_CONFIG_MINI_BUILD)

Fixed version (after fix):
 AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream& stream,           case AP4_ATOM_TYPE_HVCE:             if (atom_is_large) return AP4_ERROR_INVALID_FORMAT;             atom = AP4_HvccAtom::Create(size_32, stream);             if (atom) {                 atom->SetType(AP4_ATOM_TYPE_HVCE);             }             break;            case AP4_ATOM_TYPE_AVCE:             if (atom_is_large) return AP4_ERROR_INVALID_FORMAT;             atom = AP4_AvccAtom::Create(size_32, stream);             if (atom) {                 atom->SetType(AP4_ATOM_TYPE_AVCE);             }             break;      #if !defined(AP4_CONFIG_MINI_BUILD)

Patch:
patch: @@ -490,13 +490,17 @@ AP4_AtomFactory::CreateAtomFromStream(AP4_ByteStream& stream,
           case AP4_ATOM_TYPE_HVCE:
             if (atom_is_large) return AP4_ERROR_INVALID_FORMAT;
             atom = AP4_HvccAtom::Create(size_32, stream);
-            atom->SetType(AP4_ATOM_TYPE_HVCE);
+            if (atom) {
+                atom->SetType(AP4_ATOM_TYPE_HVCE);
+            }
             break;
 
           case AP4_ATOM_TYPE_AVCE:
             if (atom_is_large) return AP4_ERROR_INVALID_FORMAT;
             atom = AP4_AvccAtom::Create(size_32, stream);
-            atom->SetType(AP4_ATOM_TYPE_AVCE);
+            if (atom) {
+                atom->SetType(AP4_ATOM_TYPE_AVCE);
+            }
             break;
 
     #if !defined(AP4_CONFIG_MINI_BUILD)
path: Source/C++/Core/Ap4AtomFactory.cpp
Vulnerability: A NULL pointer dereference was discovered in AP4_AtomSampleTable::GetSample in Core/Ap4AtomSampleTable.cpp in Bento4 version 1.5.0-617. The vulnerability causes a segmentation fault and application crash, which leads to remote denial of service.
Vulnerability ID: CVE-2017-14640
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/axiomatic-systems/Bento4
Published: 2017-09-21
File: Source/C++/Core/Ap4AtomSampleTable.cpp
Commit message: fix for #183
Commit author: Gilles Boccon-Gibod

Vulnerable version (before fix):
 AP4_AtomSampleTable::GetSample(AP4_Ordinal index,     AP4_UI32 cts_offset = 0;     AP4_UI64 dts        = 0;     AP4_UI32 duration   = 0;     result = m_SttsAtom->GetDts(index, dts, &duration);     if (AP4_FAILED(result)) return result;     sample.SetDuration(duration);     sample.SetDts(dts);     if (m_CttsAtom == NULL) {

Fixed version (after fix):
 AP4_AtomSampleTable::GetSample(AP4_Ordinal index,     AP4_UI32 cts_offset = 0;     AP4_UI64 dts        = 0;     AP4_UI32 duration   = 0;     if (m_SttsAtom) {         result = m_SttsAtom->GetDts(index, dts, &duration);         if (AP4_FAILED(result)) return result;     }     sample.SetDuration(duration);     sample.SetDts(dts);     if (m_CttsAtom == NULL) {

Patch:
patch: @@ -140,8 +140,10 @@ AP4_AtomSampleTable::GetSample(AP4_Ordinal index,
     AP4_UI32 cts_offset = 0;
     AP4_UI64 dts        = 0;
     AP4_UI32 duration   = 0;
-    result = m_SttsAtom->GetDts(index, dts, &duration);
-    if (AP4_FAILED(result)) return result;
+    if (m_SttsAtom) {
+        result = m_SttsAtom->GetDts(index, dts, &duration);
+        if (AP4_FAILED(result)) return result;
+    }
     sample.SetDuration(duration);
     sample.SetDts(dts);
     if (m_CttsAtom == NULL) {
path: Source/C++/Core/Ap4AtomSampleTable.cpp
Vulnerability: A NULL pointer dereference was discovered in the AP4_DataAtom class in MetaData/Ap4MetaData.cpp in Bento4 version 1.5.0-617. The vulnerability causes a segmentation fault and application crash, which leads to remote denial of service.
Vulnerability ID: CVE-2017-14641
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/axiomatic-systems/Bento4
Published: 2017-09-21
File: Source/C++/MetaData/Ap4MetaData.cpp
Commit message: fix for #184
Commit author: Gilles Boccon-Gibod

Vulnerable version (before fix):
 AP4_AtomMetaDataValue::ToInteger() const +---------------------------------------------------------------------*/ AP4_DataAtom::AP4_DataAtom(const AP4_MetaData::Value& value) :     AP4_Atom(AP4_ATOM_TYPE_DATA, AP4_ATOM_HEADER_SIZE),     m_DataType(DATA_TYPE_BINARY) {     AP4_MemoryByteStream* memory = new AP4_MemoryByteStream();     AP4_Size payload_size = 8; AP4_DataAtom::AP4_DataAtom(const AP4_MetaData::Value& value) : |   AP4_DataAtom::AP4_DataAtom +---------------------------------------------------------------------*/ AP4_DataAtom::AP4_DataAtom(AP4_UI32 size, AP4_ByteStream& stream) :     AP4_Atom(AP4_ATOM_TYPE_DATA, size) {     if (size < AP4_ATOM_HEADER_SIZE+8) return; 

Fixed version (after fix):
 AP4_AtomMetaDataValue::ToInteger() const +---------------------------------------------------------------------*/ AP4_DataAtom::AP4_DataAtom(const AP4_MetaData::Value& value) :     AP4_Atom(AP4_ATOM_TYPE_DATA, AP4_ATOM_HEADER_SIZE),     m_DataType(DATA_TYPE_BINARY),     m_Source(NULL) {     AP4_MemoryByteStream* memory = new AP4_MemoryByteStream();     AP4_Size payload_size = 8; AP4_DataAtom::AP4_DataAtom(const AP4_MetaData::Value& value) : |   AP4_DataAtom::AP4_DataAtom +---------------------------------------------------------------------*/ AP4_DataAtom::AP4_DataAtom(AP4_UI32 size, AP4_ByteStream& stream) :     AP4_Atom(AP4_ATOM_TYPE_DATA, size),     m_Source(NULL) {     if (size < AP4_ATOM_HEADER_SIZE+8) return; 

Patch:
patch: @@ -1258,7 +1258,8 @@ AP4_AtomMetaDataValue::ToInteger() const
 +---------------------------------------------------------------------*/
 AP4_DataAtom::AP4_DataAtom(const AP4_MetaData::Value& value) :
     AP4_Atom(AP4_ATOM_TYPE_DATA, AP4_ATOM_HEADER_SIZE),
-    m_DataType(DATA_TYPE_BINARY)
+    m_DataType(DATA_TYPE_BINARY),
+    m_Source(NULL)
 {
     AP4_MemoryByteStream* memory = new AP4_MemoryByteStream();
     AP4_Size payload_size = 8;
@@ -1334,7 +1335,8 @@ AP4_DataAtom::AP4_DataAtom(const AP4_MetaData::Value& value) :
 |   AP4_DataAtom::AP4_DataAtom
 +---------------------------------------------------------------------*/
 AP4_DataAtom::AP4_DataAtom(AP4_UI32 size, AP4_ByteStream& stream) :
-    AP4_Atom(AP4_ATOM_TYPE_DATA, size)
+    AP4_Atom(AP4_ATOM_TYPE_DATA, size),
+    m_Source(NULL)
 {
     if (size < AP4_ATOM_HEADER_SIZE+8) return;
path: Source/C++/MetaData/Ap4MetaData.cpp
Vulnerability: A NULL pointer dereference was discovered in the AP4_HdlrAtom class in Bento4 version 1.5.0-617. The vulnerability causes a segmentation fault and application crash in AP4_StdcFileByteStream::ReadPartial in System/StdC/Ap4StdCFileByteStream.cpp, which leads to remote denial of service.
Vulnerability ID: CVE-2017-14642
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/axiomatic-systems/Bento4
Published: 2017-09-21
File: Source/C++/Core/Ap4HdlrAtom.cpp
Commit message: fix for #185
Commit author: Gilles Boccon-Gibod

Vulnerable version (before fix):
 AP4_HdlrAtom::AP4_HdlrAtom(AP4_UI32        size,     stream.ReadUI32(m_Reserved[2]);          // read the name unless it is empty     int name_size = size-(AP4_FULL_ATOM_HEADER_SIZE+20);     if (name_size == 0) return;     char* name = new char[name_size+1];     stream.Read(name, name_size);     name[name_size] = '\0'; // force a null termination     // handle a special case: the Quicktime files have a pascal

Fixed version (after fix):
 AP4_HdlrAtom::AP4_HdlrAtom(AP4_UI32        size,     stream.ReadUI32(m_Reserved[2]);          // read the name unless it is empty     if (size < AP4_FULL_ATOM_HEADER_SIZE+20) return;     AP4_UI32 name_size = size-(AP4_FULL_ATOM_HEADER_SIZE+20);     char* name = new char[name_size+1];     if (name == NULL) return;     stream.Read(name, name_size);     name[name_size] = '\0'; // force a null termination     // handle a special case: the Quicktime files have a pascal

Patch:
patch: @@ -80,9 +80,10 @@ AP4_HdlrAtom::AP4_HdlrAtom(AP4_UI32        size,
     stream.ReadUI32(m_Reserved[2]);
     
     // read the name unless it is empty
-    int name_size = size-(AP4_FULL_ATOM_HEADER_SIZE+20);
-    if (name_size == 0) return;
+    if (size < AP4_FULL_ATOM_HEADER_SIZE+20) return;
+    AP4_UI32 name_size = size-(AP4_FULL_ATOM_HEADER_SIZE+20);
     char* name = new char[name_size+1];
+    if (name == NULL) return;
     stream.Read(name, name_size);
     name[name_size] = '\0'; // force a null termination
     // handle a special case: the Quicktime files have a pascal
path: Source/C++/Core/Ap4HdlrAtom.cpp
Vulnerability: The sdp_parse_fmtp_config_h264 function in libavformat/rtpdec_h264.c in FFmpeg before 3.3.4 mishandles empty sprop-parameter-sets values, which allows remote attackers to cause a denial of service (heap buffer overflow) or possibly have unspecified other impact via a crafted sdp file.
Vulnerability ID: CVE-2017-14767
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2017-09-27
File: libavformat/rtpdec_h264.c
Commit message: avformat/rtpdec_h264: Fix heap-buffer-overflow

Fixes: rtp_sdp/poc.sdp

Found-by: Bingchang <l.bing.chang.bc@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static int sdp_parse_fmtp_config_h264(AVFormatContext *s,             parse_profile_level_id(s, h264_data, value);     } else if (!strcmp(attr, "sprop-parameter-sets")) {         int ret;         if (value[strlen(value) - 1] == ',') {             av_log(s, AV_LOG_WARNING, "Missing PPS in sprop-parameter-sets, ignoring\n");             return 0;         }

Fixed version (after fix):
 static int sdp_parse_fmtp_config_h264(AVFormatContext *s,             parse_profile_level_id(s, h264_data, value);     } else if (!strcmp(attr, "sprop-parameter-sets")) {         int ret;         if (*value == 0 || value[strlen(value) - 1] == ',') {             av_log(s, AV_LOG_WARNING, "Missing PPS in sprop-parameter-sets, ignoring\n");             return 0;         }

Patch:
patch: @@ -166,7 +166,7 @@ static int sdp_parse_fmtp_config_h264(AVFormatContext *s,
             parse_profile_level_id(s, h264_data, value);
     } else if (!strcmp(attr, "sprop-parameter-sets")) {
         int ret;
-        if (value[strlen(value) - 1] == ',') {
+        if (*value == 0 || value[strlen(value) - 1] == ',') {
             av_log(s, AV_LOG_WARNING, "Missing PPS in sprop-parameter-sets, ignoring\n");
             return 0;
         }
path: libavformat/rtpdec_h264.c
Vulnerability: Cross-Site Scripting (XSS) was discovered in ATutor before 2.2.3. The vulnerability exists due to insufficient filtration of data (url in /mods/_standard/rss_feeds/edit_feed.php). An attacker could inject arbitrary HTML and script code into a browser in the context of the vulnerable website.
Vulnerability ID: CVE-2017-14981
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/atutor/ATutor
Published: 2017-10-03
File: mods/_standard/rss_feeds/edit_feed.php
Commit message: 5815 added htmlspecialchars to filter URL var before going to the db.
Commit author: Greg Gay

Vulnerable version (before fix):
 	}  	if (!$msg->containsErrors()) { 		$_GET['url'] = $addslashes($_GET['url']);  		$sql	= "REPLACE INTO %sfeeds VALUES(%d, '%s')"; 		$result = queryDB($sql, array(TABLE_PREFIX, $feed_id, $_GET['url']));

Fixed version (after fix):
 	}  	if (!$msg->containsErrors()) {         $_GET['url'] = htmlspecialchars(strip_tags($_GET['url']), ENT_QUOTES);  		$sql	= "REPLACE INTO %sfeeds VALUES(%d, '%s')"; 		$result = queryDB($sql, array(TABLE_PREFIX, $feed_id, $_GET['url']));

Patch:
patch: @@ -38,7 +38,7 @@
 	}
 
 	if (!$msg->containsErrors()) {
-		$_GET['url'] = $addslashes($_GET['url']);
+        $_GET['url'] = htmlspecialchars(strip_tags($_GET['url']), ENT_QUOTES);
 
 		$sql	= "REPLACE INTO %sfeeds VALUES(%d, '%s')";
 		$result = queryDB($sql, array(TABLE_PREFIX, $feed_id, $_GET['url']));
path: mods/_standard/rss_feeds/edit_feed.php
Vulnerability: The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4 allows local users to obtain sensitive information from uninitialized kernel heap-memory locations via an SG_GET_REQUEST_TABLE ioctl call for /dev/sg0.
Vulnerability ID: CVE-2017-14991
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2017-10-04
File: drivers/scsi/sg.c
Commit message: scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE

When calling SG_GET_REQUEST_TABLE ioctl only a half-filled table is
returned; the remaining part will then contain stale kernel memory
information.  This patch zeroes out the entire table to avoid this
issue.

Signed-off-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Commit author: Hannes Reinecke

Vulnerable version (before fix):
 sg_fill_request_table(Sg_fd *sfp, sg_req_info_t *rinfo) 	list_for_each_entry(srp, &sfp->rq_list, entry) { 		if (val > SG_MAX_QUEUE) 			break; 		memset(&rinfo[val], 0, SZ_SG_REQ_INFO); 		rinfo[val].req_state = srp->done + 1; 		rinfo[val].problem = 			srp->header.masked_status & sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg) 		else { 			sg_req_info_t *rinfo;  			rinfo = kmalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE, 								GFP_KERNEL); 			if (!rinfo) 				return -ENOMEM; 			read_lock_irqsave(&sfp->rq_list_lock, iflags);

Fixed version (after fix):
 sg_fill_request_table(Sg_fd *sfp, sg_req_info_t *rinfo) 	list_for_each_entry(srp, &sfp->rq_list, entry) { 		if (val > SG_MAX_QUEUE) 			break; 		rinfo[val].req_state = srp->done + 1; 		rinfo[val].problem = 			srp->header.masked_status & sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg) 		else { 			sg_req_info_t *rinfo;  			rinfo = kzalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE, 					GFP_KERNEL); 			if (!rinfo) 				return -ENOMEM; 			read_lock_irqsave(&sfp->rq_list_lock, iflags);

Patch:
patch: @@ -839,7 +839,6 @@ sg_fill_request_table(Sg_fd *sfp, sg_req_info_t *rinfo)
 	list_for_each_entry(srp, &sfp->rq_list, entry) {
 		if (val > SG_MAX_QUEUE)
 			break;
-		memset(&rinfo[val], 0, SZ_SG_REQ_INFO);
 		rinfo[val].req_state = srp->done + 1;
 		rinfo[val].problem =
 			srp->header.masked_status &
@@ -1047,8 +1046,8 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
 		else {
 			sg_req_info_t *rinfo;
 
-			rinfo = kmalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE,
-								GFP_KERNEL);
+			rinfo = kzalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE,
+					GFP_KERNEL);
 			if (!rinfo)
 				return -ENOMEM;
 			read_lock_irqsave(&sfp->rq_list_lock, iflags);
path: drivers/scsi/sg.c
Vulnerability: The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a peel-off action, which allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls.
Vulnerability ID: CVE-2017-15115
CWE: CWE-416
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2017-11-15
File: net/sctp/socket.c
Commit message: sctp: do not peel off an assoc from one netns to another one

Now when peeling off an association to the sock in another netns, all
transports in this assoc are not to be rehashed and keep use the old
key in hashtable.

As a transport uses sk->net as the hash key to insert into hashtable,
it would miss removing these transports from hashtable due to the new
netns when closing the sock and all transports are being freeed, then
later an use-after-free issue could be caused when looking up an asoc
and dereferencing those transports.

This is a very old issue since very beginning, ChunYu found it with
syzkaller fuzz testing with this series:

  socket$inet6_sctp()
  bind$inet6()
  sendto$inet6()
  unshare(0x40000000)
  getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST()
  getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF()

This patch is to block this call when peeling one assoc off from one
netns to another one, so that the netns of all transport would not
go out-sync with the key in hashtable.

Note that this patch didn't fix it by rehashing transports, as it's
difficult to handle the situation when the tuple is already in use
in the new netns. Besides, no one would like to peel off one assoc
to another netns, considering ipaddrs, ifaces, etc. are usually
different.

Reported-by: ChunYu Wang <chunwang@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Xin Long

Vulnerable version (before fix):
 int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp) 	struct socket *sock; 	int err = 0;  	if (!asoc) 		return -EINVAL; 

Fixed version (after fix):
 int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp) 	struct socket *sock; 	int err = 0;  	/* Do not peel off from one netns to another one. */ 	if (!net_eq(current->nsproxy->net_ns, sock_net(sk))) 		return -EINVAL;  	if (!asoc) 		return -EINVAL; 

Patch:
patch: @@ -4906,6 +4906,10 @@ int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp)
 	struct socket *sock;
 	int err = 0;
 
+	/* Do not peel off from one netns to another one. */
+	if (!net_eq(current->nsproxy->net_ns, sock_net(sk)))
+		return -EINVAL;
+
 	if (!asoc)
 		return -EINVAL;
path: net/sctp/socket.c
Vulnerability: include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.
Vulnerability ID: CVE-2017-15194
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/Cacti/cacti
Published: 2017-10-11
File: include/global_session.php
Commit message: XSS fix (#1017)

Fix for issue #1010
Commit author: Patrick

Vulnerable version (before fix):
 	var cactiVersion='<?php print $config['cacti_version'];?>'; 	var theme='<?php print get_selected_theme();?>'; 	var refreshIsLogout=<?php print $refreshIsLogout;?>; 	var refreshPage='<?php print $myrefresh['page'];?>'; 	var refreshMSeconds=<?php print $myrefresh['seconds']*1000;?>; 	var urlPath='<?php print $config['url_path'];?>'; 	var previousPage=''; 	var requestURI='<?php print $_SERVER['REQUEST_URI'];?>'; 	var searchFilter='<?php print __('Enter a search term');?>'; 	var searchRFilter='<?php print __('Enter a regular expression');?>'; 	var noFileSelected='<?php print __('No file selected');?>';

Fixed version (after fix):
 	var cactiVersion='<?php print $config['cacti_version'];?>'; 	var theme='<?php print get_selected_theme();?>'; 	var refreshIsLogout=<?php print $refreshIsLogout;?>; 	var refreshPage='<?php print htmlspecialchars($myrefresh['page']);?>'; 	var refreshMSeconds=<?php print $myrefresh['seconds']*1000;?>; 	var urlPath='<?php print $config['url_path'];?>'; 	var previousPage=''; 	var requestURI='<?php print htmlspecialchars($_SERVER['REQUEST_URI']);?>'; 	var searchFilter='<?php print __('Enter a search term');?>'; 	var searchRFilter='<?php print __('Enter a regular expression');?>'; 	var noFileSelected='<?php print __('No file selected');?>';

Patch:
patch: @@ -84,11 +84,11 @@
 	var cactiVersion='<?php print $config['cacti_version'];?>';
 	var theme='<?php print get_selected_theme();?>';
 	var refreshIsLogout=<?php print $refreshIsLogout;?>;
-	var refreshPage='<?php print $myrefresh['page'];?>';
+	var refreshPage='<?php print htmlspecialchars($myrefresh['page']);?>';
 	var refreshMSeconds=<?php print $myrefresh['seconds']*1000;?>;
 	var urlPath='<?php print $config['url_path'];?>';
 	var previousPage='';
-	var requestURI='<?php print $_SERVER['REQUEST_URI'];?>';
+	var requestURI='<?php print htmlspecialchars($_SERVER['REQUEST_URI']);?>';
 	var searchFilter='<?php print __('Enter a search term');?>';
 	var searchRFilter='<?php print __('Enter a regular expression');?>';
 	var noFileSelected='<?php print __('No file selected');?>';
path: include/global_session.php
Vulnerability: Stored XSS vulnerability in Flyspray 1.0-rc4 before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges and also to execute JavaScript against other users (including unauthenticated users), via the name, title, or id parameter to plugins/dokuwiki/lib/plugins/changelinks/syntax.php.
Vulnerability ID: CVE-2017-15214
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/Flyspray/flyspray
Published: 2017-10-11
File: plugins/dokuwiki/lib/plugins/changelinks/syntax.php
Commit message: quickfix for dokuwiki links
Commit author: peterdd

Vulnerable version (before fix):
 function render($mode, &$renderer, $data) {             $link['more']   = '';             $link['class']  = 'internallink';             $link['url']    = DOKU_INTERNAL_LINK . $id;             $link['name']   = ($name) ? $name : $id;             $link['title']  = ($name) ? $name : $id;             //add search string             if($search){                 ($conf['userewrite']) ? $link['url'].='?s=' : $link['url'].='&amp;s='; function render($mode, &$renderer, $data) { }   //Setup VIM: ex: et ts=4 enc=utf-8 : ?>\ No newline at end of file

Fixed version (after fix):
 function render($mode, &$renderer, $data) {             $link['more']   = '';             $link['class']  = 'internallink';             $link['url']    = DOKU_INTERNAL_LINK . $id;                       if(is_array($name)){                $link['name']   = (isset($name['title'])) ? hsc($name['title']) : hsc($id);                $link['title'] = $id;             } else{                $link['name']   = ($name) ? hsc($name) : hsc($id);                $link['title'] = ($name) ? $name : $id;             }              //add search string             if($search){                 ($conf['userewrite']) ? $link['url'].='?s=' : $link['url'].='&amp;s='; function render($mode, &$renderer, $data) { }   //Setup VIM: ex: et ts=4 enc=utf-8 :\ No newline at end of file ?>

Patch:
patch: @@ -130,8 +130,15 @@ function render($mode, &$renderer, $data) {
             $link['more']   = '';
             $link['class']  = 'internallink';
             $link['url']    = DOKU_INTERNAL_LINK . $id;
-            $link['name']   = ($name) ? $name : $id;
-            $link['title']  = ($name) ? $name : $id;
+         
+            if(is_array($name)){
+               $link['name']   = (isset($name['title'])) ? hsc($name['title']) : hsc($id);
+               $link['title'] = $id;
+            } else{
+               $link['name']   = ($name) ? hsc($name) : hsc($id);
+               $link['title'] = ($name) ? $name : $id;
+            }
+
             //add search string
             if($search){
                 ($conf['userewrite']) ? $link['url'].='?s=' : $link['url'].='&amp;s=';
@@ -147,4 +154,4 @@ function render($mode, &$renderer, $data) {
 }
  
 //Setup VIM: ex: et ts=4 enc=utf-8 :
-?>
\ No newline at end of file
+?>
path: plugins/dokuwiki/lib/plugins/changelinks/syntax.php