rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Heap buffer overflow in the print_udta function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.
Vulnerability ID: CVE-2021-32136
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/gpac/gpac
Published: 2021-09-13
File: applications/mp4box/filedump.c
Commit message: fixed #1765
Commit author: jeanlf

Vulnerable version (before fix):
 void print_udta(GF_ISOFile *file, u32 track_number, Bool has_itags) 			u32 udta_size; 			gf_isom_get_user_data(file, track_number, type, uuid, j+1, &udta, &udta_size); 			if (!udta) continue; 			if (gf_utf8_is_legal(udta, udta_size)) { 				if (first) { 					fprintf(stderr, "\n"); 					first = GF_FALSE; 				} 				fprintf(stderr, "\t%s\n", (char *) udta); 			} 			gf_free(udta); 		}

Fixed version (after fix):
 void print_udta(GF_ISOFile *file, u32 track_number, Bool has_itags) 			u32 udta_size; 			gf_isom_get_user_data(file, track_number, type, uuid, j+1, &udta, &udta_size); 			if (!udta) continue; 			if (udta_size && gf_utf8_is_legal(udta, udta_size)) { 				u32 idx; 				if (first) { 					fprintf(stderr, "\n"); 					first = GF_FALSE; 				} 				fprintf(stderr, "\t"); 				for (idx=0; idx<udta_size; idx++) { 					if (!udta[idx]) break; 					fprintf(stderr, "%c", udta[idx]); 				} 				fprintf(stderr, "\n"); 			} 			gf_free(udta); 		}

Patch:
patch: @@ -1895,12 +1895,18 @@ void print_udta(GF_ISOFile *file, u32 track_number, Bool has_itags)
 			u32 udta_size;
 			gf_isom_get_user_data(file, track_number, type, uuid, j+1, &udta, &udta_size);
 			if (!udta) continue;
-			if (gf_utf8_is_legal(udta, udta_size)) {
+			if (udta_size && gf_utf8_is_legal(udta, udta_size)) {
+				u32 idx;
 				if (first) {
 					fprintf(stderr, "\n");
 					first = GF_FALSE;
 				}
-				fprintf(stderr, "\t%s\n", (char *) udta);
+				fprintf(stderr, "\t");
+				for (idx=0; idx<udta_size; idx++) {
+					if (!udta[idx]) break;
+					fprintf(stderr, "%c", udta[idx]);
+				}
+				fprintf(stderr, "\n");
 			}
 			gf_free(udta);
 		}
path: applications/mp4box/filedump.c
Vulnerability: Heap buffer overflow in the URL_GetProtocolType function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.
Vulnerability ID: CVE-2021-32137
CWE: CWE-787
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2021-09-13
File: src/isomedia/media.c
Commit message: fixed #1766 (fuzz)
Commit author: jeanlf

Vulnerable version (before fix):
 GF_Err Media_GetSample(GF_MediaBox *mdia, u32 sampleNumber, GF_ISOSample **samp,  GF_Err Media_CheckDataEntry(GF_MediaBox *mdia, u32 dataEntryIndex) {  	GF_DataEntryURLBox *entry; 	GF_DataMap *map; 	GF_Err e; GF_Err Media_CheckDataEntry(GF_MediaBox *mdia, u32 dataEntryIndex) 	if (entry->flags == 1) return GF_OK;  	//ok, not self contained, let's go for it... 	//we don't know what's a URN yet 	if (entry->type == GF_ISOM_BOX_TYPE_URN) return GF_NOT_SUPPORTED; 	if (mdia->mediaTrack->moov->mov->openMode == GF_ISOM_OPEN_WRITE) { 		e = gf_isom_datamap_new(entry->location, NULL, GF_ISOM_DATA_MAP_READ, &map); 	} else {

Fixed version (after fix):
 GF_Err Media_GetSample(GF_MediaBox *mdia, u32 sampleNumber, GF_ISOSample **samp,  GF_Err Media_CheckDataEntry(GF_MediaBox *mdia, u32 dataEntryIndex) { 	GF_DataEntryURLBox *entry; 	GF_DataMap *map; 	GF_Err e; GF_Err Media_CheckDataEntry(GF_MediaBox *mdia, u32 dataEntryIndex) 	if (entry->flags == 1) return GF_OK;  	//ok, not self contained, let's go for it... 	//we only support alias and URL boxes 	if ((entry->type != GF_ISOM_BOX_TYPE_URL) && (entry->type != GF_QT_BOX_TYPE_ALIS) ) 		return GF_NOT_SUPPORTED;  	if (mdia->mediaTrack->moov->mov->openMode == GF_ISOM_OPEN_WRITE) { 		e = gf_isom_datamap_new(entry->location, NULL, GF_ISOM_DATA_MAP_READ, &map); 	} else {

Patch:
patch: @@ -674,7 +674,6 @@ GF_Err Media_GetSample(GF_MediaBox *mdia, u32 sampleNumber, GF_ISOSample **samp,
 
 GF_Err Media_CheckDataEntry(GF_MediaBox *mdia, u32 dataEntryIndex)
 {
-
 	GF_DataEntryURLBox *entry;
 	GF_DataMap *map;
 	GF_Err e;
@@ -685,8 +684,10 @@ GF_Err Media_CheckDataEntry(GF_MediaBox *mdia, u32 dataEntryIndex)
 	if (entry->flags == 1) return GF_OK;
 
 	//ok, not self contained, let's go for it...
-	//we don't know what's a URN yet
-	if (entry->type == GF_ISOM_BOX_TYPE_URN) return GF_NOT_SUPPORTED;
+	//we only support alias and URL boxes
+	if ((entry->type != GF_ISOM_BOX_TYPE_URL) && (entry->type != GF_QT_BOX_TYPE_ALIS) )
+		return GF_NOT_SUPPORTED;
+
 	if (mdia->mediaTrack->moov->mov->openMode == GF_ISOM_OPEN_WRITE) {
 		e = gf_isom_datamap_new(entry->location, NULL, GF_ISOM_DATA_MAP_READ, &map);
 	} else {
path: src/isomedia/media.c
Vulnerability: Buffer overflow vulnerability in function gf_fprintf in os_file.c in gpac before 1.0.1 allows attackers to execute arbitrary code. The fixed version is 1.0.1.
Vulnerability ID: CVE-2021-32268
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/gpac/gpac
Published: 2021-09-20
File: src/isomedia/box_code_base.c
Commit message: fixed #1587
Commit author: jeanlf

Vulnerable version (before fix):
 GF_Err url_box_read(GF_Box *s, GF_BitStream *bs) 		ptr->location = (char*)gf_malloc((u32) ptr->size); 		if (! ptr->location) return GF_OUT_OF_MEM; 		gf_bs_read_data(bs, ptr->location, (u32)ptr->size); 	} 	return GF_OK; }

Fixed version (after fix):
 GF_Err url_box_read(GF_Box *s, GF_BitStream *bs) 		ptr->location = (char*)gf_malloc((u32) ptr->size); 		if (! ptr->location) return GF_OUT_OF_MEM; 		gf_bs_read_data(bs, ptr->location, (u32)ptr->size); 		if (ptr->location[ptr->size-1]) { 			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] url box location is not 0-terminated\n" )); 			return GF_ISOM_INVALID_FILE; 		} 	} 	return GF_OK; }

Patch:
patch: @@ -580,6 +580,10 @@ GF_Err url_box_read(GF_Box *s, GF_BitStream *bs)
 		ptr->location = (char*)gf_malloc((u32) ptr->size);
 		if (! ptr->location) return GF_OUT_OF_MEM;
 		gf_bs_read_data(bs, ptr->location, (u32)ptr->size);
+		if (ptr->location[ptr->size-1]) {
+			GF_LOG(GF_LOG_ERROR, GF_LOG_CONTAINER, ("[iso file] url box location is not 0-terminated\n" ));
+			return GF_ISOM_INVALID_FILE;
+		}
 	}
 	return GF_OK;
 }
path: src/isomedia/box_code_base.c
Vulnerability: An issue was discovered in faad2 before 2.10.0. A heap-buffer-overflow exists in the function stszin located in mp4read.c. It allows an attacker to cause Code Execution.
Vulnerability ID: CVE-2021-32272
CWE: CWE-787
Severity score: 6.4
Project: https://github.com/knik0/faad2
Published: 2021-09-20
File: frontend/mp4read.c
Commit message: fix heap-buffer-overflow in mp4read.c

This originated from an integer overflow: If mp4config.frame.ents
would be read-in with a value of (uint32t)(-1), it would overflow to 0
in the size calculation for the allocation in the next line. The
malloc() function would then successfully return a pointer to a memory
region of size 0, which will cause a segfault when written to.

Fixes #57.
Commit author: Fabian Greffrath

Vulnerable version (before fix):
 static int stszin(int size)     u32in();     // Number of entries     mp4config.frame.ents = u32in();     // fixme: check atom size     mp4config.frame.data = malloc(sizeof(*mp4config.frame.data)                                   * (mp4config.frame.ents + 1)); 

Fixed version (after fix):
 static int stszin(int size)     u32in();     // Number of entries     mp4config.frame.ents = u32in();      if (!(mp4config.frame.ents + 1))         return ERR_FAIL;      mp4config.frame.data = malloc(sizeof(*mp4config.frame.data)                                   * (mp4config.frame.ents + 1)); 

Patch:
patch: @@ -344,7 +344,10 @@ static int stszin(int size)
     u32in();
     // Number of entries
     mp4config.frame.ents = u32in();
-    // fixme: check atom size
+
+    if (!(mp4config.frame.ents + 1))
+        return ERR_FAIL;
+
     mp4config.frame.data = malloc(sizeof(*mp4config.frame.data)
                                   * (mp4config.frame.ents + 1));
path: frontend/mp4read.c
Vulnerability: net/bluetooth/hci_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI controller.
Vulnerability ID: CVE-2021-32399
CWE: CWE-362
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2021-05-10
File: net/bluetooth/hci_request.c
Commit message: bluetooth: eliminate the potential race condition when removing the HCI controller

There is a possible race condition vulnerability between issuing a HCI
command and removing the cont.  Specifically, functions hci_req_sync()
and hci_dev_do_close() can race each other like below:

thread-A in hci_req_sync()      |   thread-B in hci_dev_do_close()
                                |   hci_req_sync_lock(hdev);
test_bit(HCI_UP, &hdev->flags); |
...                             |   test_and_clear_bit(HCI_UP, &hdev->flags)
hci_req_sync_lock(hdev);        |
                                |
In this commit we alter the sequence in function hci_req_sync(). Hence,
the thread-A cannot issue th.

Signed-off-by: Lin Ma <linma@zju.edu.cn>
Cc: Marcel Holtmann <marcel@holtmann.org>
Fixes: 7c6a329e4447 ("[Bluetooth] Fix regression from using default link policy")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Commit author: Lin Ma

Vulnerable version (before fix):
 int hci_req_sync(struct hci_dev *hdev, int (*req)(struct hci_request *req, { 	int ret;  	if (!test_bit(HCI_UP, &hdev->flags)) 		return -ENETDOWN;  	/* Serialize all requests */ 	hci_req_sync_lock(hdev); 	ret = __hci_req_sync(hdev, req, opt, timeout, hci_status); 	hci_req_sync_unlock(hdev);  	return ret;

Fixed version (after fix):
 int hci_req_sync(struct hci_dev *hdev, int (*req)(struct hci_request *req, { 	int ret;  	/* Serialize all requests */ 	hci_req_sync_lock(hdev); 	/* check the state after obtaing the lock to protect the HCI_UP 	 * against any races from hci_dev_do_close when the controller 	 * gets removed. 	 */ 	if (test_bit(HCI_UP, &hdev->flags)) 		ret = __hci_req_sync(hdev, req, opt, timeout, hci_status); 	else 		ret = -ENETDOWN; 	hci_req_sync_unlock(hdev);  	return ret;

Patch:
patch: @@ -272,12 +272,16 @@ int hci_req_sync(struct hci_dev *hdev, int (*req)(struct hci_request *req,
 {
 	int ret;
 
-	if (!test_bit(HCI_UP, &hdev->flags))
-		return -ENETDOWN;
-
 	/* Serialize all requests */
 	hci_req_sync_lock(hdev);
-	ret = __hci_req_sync(hdev, req, opt, timeout, hci_status);
+	/* check the state after obtaing the lock to protect the HCI_UP
+	 * against any races from hci_dev_do_close when the controller
+	 * gets removed.
+	 */
+	if (test_bit(HCI_UP, &hdev->flags))
+		ret = __hci_req_sync(hdev, req, opt, timeout, hci_status);
+	else
+		ret = -ENETDOWN;
 	hci_req_sync_unlock(hdev);
 
 	return ret;
path: net/bluetooth/hci_request.c
Vulnerability: abcm2ps v8.14.11 was discovered to contain an out-of-bounds read in the function calculate_beam at draw.c.
Vulnerability ID: CVE-2021-32434
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/leesavide/abcm2ps
Published: 2022-03-10
File: parse.c
Commit message: fix: array overflow when wrong duration in voice overlay

Issue #83,
Commit author: Jean-Francois Moine

Vulnerable version (before fix):
 static char txt_no_note[] = "No note in voice overlay"; 			error(1, s, "Erroneous end of voice overlap"); 			return; 		} 		if (p_voice->time != over_mxtime) 			error(1, s, tx_wrong_dur); 		curvoice = &voice_tb[over_voice]; 		over_mxtime = 0; 		over_voice = -1; 		over_time = -1;

Fixed version (after fix):
 static char txt_no_note[] = "No note in voice overlay"; 			error(1, s, "Erroneous end of voice overlap"); 			return; 		} 		curvoice = &voice_tb[over_voice]; 		if (p_voice->time != over_mxtime) { 			error(1, s, tx_wrong_dur); 			if (p_voice->time > over_mxtime) 				curvoice->time = p_voice->time; 			else 				p_voice->time = curvoice->time; 		} 		over_mxtime = 0; 		over_voice = -1; 		over_time = -1;

Patch:
patch: @@ -2011,9 +2011,14 @@ static char txt_no_note[] = "No note in voice overlay";
 			error(1, s, "Erroneous end of voice overlap");
 			return;
 		}
-		if (p_voice->time != over_mxtime)
-			error(1, s, tx_wrong_dur);
 		curvoice = &voice_tb[over_voice];
+		if (p_voice->time != over_mxtime) {
+			error(1, s, tx_wrong_dur);
+			if (p_voice->time > over_mxtime)
+				curvoice->time = p_voice->time;
+			else
+				p_voice->time = curvoice->time;
+		}
 		over_mxtime = 0;
 		over_voice = -1;
 		over_time = -1;
path: parse.c
Vulnerability: Stack-based buffer overflow in the function get_key in parse.c of abcm2ps v8.14.11 allows remote attackers to cause a Denial of Service (DoS) via unspecified vectors.
Vulnerability ID: CVE-2021-32435
CWE: CWE-787
Severity score: 2.9
Project: https://github.com/leesavide/abcm2ps
Published: 2022-03-10
File: abcparse.c
Commit message: fix: crash when accidental without a note at start of line after K:

Issue #84.
Commit author: Jean-Francois Moine

Vulnerable version (before fix):
 static int parse_line(char *p) 		case CHAR_NOTE: 			p = parse_note(p - 1, flags); 			flags &= ABC_F_GRACE; 			parse.last_sym->u.note.slur_st = slur; 			slur = 0; 			if (parse.last_sym->u.note.notes[0].len > 0) /* if not space */ 				curvoice->last_note = parse.last_sym; 			break; 		case CHAR_SLASH:		/* '/' */ 			if (flags & ABC_F_GRACE) static int parse_line(char *p) 			if (p[1] != ':') { 				p = parse_note(p - 1, flags); /* chord */ 				flags &= ABC_F_GRACE; 				parse.last_sym->u.note.slur_st = slur; 				slur = 0; 				curvoice->last_note = parse.last_sym; 				break; 			}  static char *parse_note(char *p, 		syntax("Not a note in grace note sequence", p); 		goto err; 	} 	return p;  err:

Fixed version (after fix):
 static int parse_line(char *p) 		case CHAR_NOTE: 			p = parse_note(p - 1, flags); 			flags &= ABC_F_GRACE; 			if (slur && parse.last_sym->u.note.notes[0].len) { 				parse.last_sym->u.note.slur_st = slur; 				slur = 0; 			} 			break; 		case CHAR_SLASH:		/* '/' */ 			if (flags & ABC_F_GRACE) static int parse_line(char *p) 			if (p[1] != ':') { 				p = parse_note(p - 1, flags); /* chord */ 				flags &= ABC_F_GRACE; 				if (slur && parse.last_sym->u.note.notes[0].len) { 					parse.last_sym->u.note.slur_st = slur; 					slur = 0; 				} 				break; 			}  static char *parse_note(char *p, 		syntax("Not a note in grace note sequence", p); 		goto err; 	} 	if (s->u.note.notes[0].len > 0) /* if not space */ 		curvoice->last_note = s; 	return p;  err:

Patch:
patch: @@ -2040,10 +2040,10 @@ static int parse_line(char *p)
 		case CHAR_NOTE:
 			p = parse_note(p - 1, flags);
 			flags &= ABC_F_GRACE;
-			parse.last_sym->u.note.slur_st = slur;
-			slur = 0;
-			if (parse.last_sym->u.note.notes[0].len > 0) /* if not space */
-				curvoice->last_note = parse.last_sym;
+			if (slur && parse.last_sym->u.note.notes[0].len) {
+				parse.last_sym->u.note.slur_st = slur;
+				slur = 0;
+			}
 			break;
 		case CHAR_SLASH:		/* '/' */
 			if (flags & ABC_F_GRACE)
@@ -2078,9 +2078,10 @@ static int parse_line(char *p)
 			if (p[1] != ':') {
 				p = parse_note(p - 1, flags); /* chord */
 				flags &= ABC_F_GRACE;
-				parse.last_sym->u.note.slur_st = slur;
-				slur = 0;
-				curvoice->last_note = parse.last_sym;
+				if (slur && parse.last_sym->u.note.notes[0].len) {
+					parse.last_sym->u.note.slur_st = slur;
+					slur = 0;
+				}
 				break;
 			}
 
@@ -2511,6 +2512,8 @@ static char *parse_note(char *p,
 		syntax("Not a note in grace note sequence", p);
 		goto err;
 	}
+	if (s->u.note.notes[0].len > 0) /* if not space */
+		curvoice->last_note = s;
 	return p;
 
 err:
path: abcparse.c
Vulnerability: The gf_hinter_finalize function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Vulnerability ID: CVE-2021-32437
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2021-08-11
File: src/media_tools/isom_hinter.c
Commit message: fixed #1770 (fuzz)
Commit author: jeanlf

Vulnerable version (before fix):
 GF_Err gf_hinter_finalize(GF_ISOFile *file, GF_SDP_IODProfile IOD_Profile, u32 b 		esd = gf_isom_get_esd(file, sceneT, 1); 		if (gf_isom_get_sample_count(file, sceneT)==1) { 			samp = gf_isom_get_sample(file, sceneT, 1, &descIndex); 			if (gf_hinter_can_embbed_data(samp->data, samp->dataLength, GF_STREAM_SCENE)) {  				slc.timeScale = slc.timestampResolution = gf_isom_get_media_timescale(file, sceneT); 				slc.OCRResolution = 1000;

Fixed version (after fix):
 GF_Err gf_hinter_finalize(GF_ISOFile *file, GF_SDP_IODProfile IOD_Profile, u32 b 		esd = gf_isom_get_esd(file, sceneT, 1); 		if (gf_isom_get_sample_count(file, sceneT)==1) { 			samp = gf_isom_get_sample(file, sceneT, 1, &descIndex); 			if (samp && gf_hinter_can_embbed_data(samp->data, samp->dataLength, GF_STREAM_SCENE)) {  				slc.timeScale = slc.timestampResolution = gf_isom_get_media_timescale(file, sceneT); 				slc.OCRResolution = 1000;

Patch:
patch: @@ -1233,7 +1233,7 @@ GF_Err gf_hinter_finalize(GF_ISOFile *file, GF_SDP_IODProfile IOD_Profile, u32 b
 		esd = gf_isom_get_esd(file, sceneT, 1);
 		if (gf_isom_get_sample_count(file, sceneT)==1) {
 			samp = gf_isom_get_sample(file, sceneT, 1, &descIndex);
-			if (gf_hinter_can_embbed_data(samp->data, samp->dataLength, GF_STREAM_SCENE)) {
+			if (samp && gf_hinter_can_embbed_data(samp->data, samp->dataLength, GF_STREAM_SCENE)) {
 
 				slc.timeScale = slc.timestampResolution = gf_isom_get_media_timescale(file, sceneT);
 				slc.OCRResolution = 1000;
path: src/media_tools/isom_hinter.c
Vulnerability: The gf_media_export_filters function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.
Vulnerability ID: CVE-2021-32438
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/gpac/gpac
Published: 2021-08-11
File: src/media_tools/media_export.c
Commit message: fixed #1769 (fuzz)
Commit author: jeanlf

Vulnerable version (before fix):
 static GF_Err gf_media_export_filters(GF_MediaExporter *dumper) 		} 		esd = gf_media_map_esd(dumper->file, track_num, 0); 		sample_count = gf_isom_get_sample_count(dumper->file, dumper->trackID); 		if (esd) { 			if (esd->decoderConfig->objectTypeIndication<GF_CODECID_LAST_MPEG4_MAPPING) { 				codec_id = gf_codecid_from_oti(esd->decoderConfig->streamType, esd->decoderConfig->objectTypeIndication); #ifndef GPAC_DISABLE_AV_PARSERS

Fixed version (after fix):
 static GF_Err gf_media_export_filters(GF_MediaExporter *dumper) 		} 		esd = gf_media_map_esd(dumper->file, track_num, 0); 		sample_count = gf_isom_get_sample_count(dumper->file, dumper->trackID); 		if (esd && esd->decoderConfig) { 			if (esd->decoderConfig->objectTypeIndication<GF_CODECID_LAST_MPEG4_MAPPING) { 				codec_id = gf_codecid_from_oti(esd->decoderConfig->streamType, esd->decoderConfig->objectTypeIndication); #ifndef GPAC_DISABLE_AV_PARSERS

Patch:
patch: @@ -1108,7 +1108,7 @@ static GF_Err gf_media_export_filters(GF_MediaExporter *dumper)
 		}
 		esd = gf_media_map_esd(dumper->file, track_num, 0);
 		sample_count = gf_isom_get_sample_count(dumper->file, dumper->trackID);
-		if (esd) {
+		if (esd && esd->decoderConfig) {
 			if (esd->decoderConfig->objectTypeIndication<GF_CODECID_LAST_MPEG4_MAPPING) {
 				codec_id = gf_codecid_from_oti(esd->decoderConfig->streamType, esd->decoderConfig->objectTypeIndication);
 #ifndef GPAC_DISABLE_AV_PARSERS
path: src/media_tools/media_export.c
Vulnerability: Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.
Vulnerability ID: CVE-2021-32615
CWE: CWE-89
Severity score: 6.4
Project: https://github.com/Piwigo/Piwigo
Published: 2021-05-13
File: admin/user_list_backend.php
Commit message: fixes #1410 check on user input to prevent SQL injection
Commit author: plegall

Vulnerable version (before fix):
   $sOrder = "ORDER BY  ";   $i = 0;   $col = $_REQUEST["order"][0]["column"];   if ( $_REQUEST['columns'][$col]["searchable"] == "true" )   {     $sOrder .= $aColumns[ $col ].' '.$_REQUEST["order"][0]["dir"].', ';   }

Fixed version (after fix):
   $sOrder = "ORDER BY  ";   $i = 0;   $col = $_REQUEST["order"][0]["column"];   if ( $_REQUEST['columns'][$col]["searchable"] == "true" and preg_match('/^(asc|desc)$/i', $_REQUEST["order"][0]["dir"]))   {     $sOrder .= $aColumns[ $col ].' '.$_REQUEST["order"][0]["dir"].', ';   }

Patch:
patch: @@ -65,7 +65,7 @@
   $sOrder = "ORDER BY  ";
   $i = 0;
   $col = $_REQUEST["order"][0]["column"];
-  if ( $_REQUEST['columns'][$col]["searchable"] == "true" )
+  if ( $_REQUEST['columns'][$col]["searchable"] == "true" and preg_match('/^(asc|desc)$/i', $_REQUEST["order"][0]["dir"]))
   {
     $sOrder .= $aColumns[ $col ].' '.$_REQUEST["order"][0]["dir"].', ';
   }
path: admin/user_list_backend.php
Vulnerability: Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Circles application is upgraded to 0.21.3, 0.20.10 or 0.19.14 to resolve this issue. As a workaround users may use a browser that has support for Content-Security-Policy. A notable exemption is Internet Explorer which does not support CSP properly.
Vulnerability ID: CVE-2021-32782
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/nextcloud/circles
Published: 2021-09-07
File: js/files/circles.files.list.js
Commit message: escapeHTML when browsing shared files

Signed-off-by: Maxence Lange <maxence@artificial-owl.com>
Commit author: Maxence Lange

Vulnerable version (before fix):
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.  *  */ (function() { 	/** 	 * @class OCA.Circles.FileList 				},  				formatResult: function (circle) { 					return circle.name; 				},  				formatSelection: function (circle) { 					return circle.name; 					//return OC.SystemTags.getDescriptiveTag(tag)[0].outerHTML; 				},  				sortResults: function(results) {

Fixed version (after fix):
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.  *  */   function escapeHTML(text) { 	return text.toString() 		.split('&').join('&amp;') 		.split('<').join('&lt;') 		.split('>').join('&gt;') 		.split('"').join('&quot;') 		.split('\'').join('&#039;') }  (function() { 	/** 	 * @class OCA.Circles.FileList 				},  				formatResult: function (circle) { 					return escapeHTML(circle.name); 				},  				formatSelection: function (circle) { 					return escapeHTML(circle.name); 				},  				sortResults: function(results) {

Patch:
patch: @@ -22,6 +22,17 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  *
  */
+
+
+function escapeHTML(text) {
+	return text.toString()
+		.split('&').join('&amp;')
+		.split('<').join('&lt;')
+		.split('>').join('&gt;')
+		.split('"').join('&quot;')
+		.split('\'').join('&#039;')
+}
+
 (function() {
 	/**
 	 * @class OCA.Circles.FileList
@@ -124,12 +135,11 @@
 				},
 
 				formatResult: function (circle) {
-					return circle.name;
+					return escapeHTML(circle.name);
 				},
 
 				formatSelection: function (circle) {
-					return circle.name;
-					//return OC.SystemTags.getDescriptiveTag(tag)[0].outerHTML;
+					return escapeHTML(circle.name);
 				},
 
 				sortResults: function(results) {
path: js/files/circles.files.list.js