Refinements for some CVEs as requested in the review

These CVEs contained some issues, as pointed out in GH-581.

 - CVE-2011-4190
 - CVE-2013-3703
 - CVE-2014-0593
 - CVE-2014-5220

2011/4xxx/CVE-2011-4190.json

@@ -78,7 +78,7 @@
    "references": {
       "reference_data": [
          {
-            "refsource": "SUSE",
+            "refsource": "CONFIRM",
             "url": "https://www.suse.com/security/cve/CVE-2011-4190/"
          },
          {
@@ -94,4 +94,4 @@
       ],
       "discovery": "UNKNOWN"
    }
-}
+}

2013/3xxx/CVE-2013-3703.json

@@ -77,7 +77,6 @@
             "url": "https://bugzilla.suse.com/show_bug.cgi?id=866966"
          },
          {
-            "name": "git commit",
             "refsource": "CONFIRM",
             "url": "https://github.com/openSUSE/open-build-service/commit/06ad7fdbdd7eb2fef8947d14c4cdd00d8f6387b1"
          }
@@ -89,4 +88,4 @@
       ],
       "discovery": "INTERNAL"
    }
-}
+}

2014/0xxx/CVE-2014-0593.json

@@ -1,10 +1,10 @@
 {
    "CVE_data_meta": {
       "ASSIGNER": "security@suse.de",
-      "DATE_PUBLIC": "2014-03-26T00:00:00.000Z",
-      "ID": "CVE-2014-0594",
+      "DATE_PUBLIC": "2014-03-03T00:00:00.000Z",
+      "ID": "CVE-2014-0593",
       "STATE": "PUBLIC",
-      "TITLE": "CSRF protection incorrectly disabled"
+      "TITLE": "sed command injection"
    },
    "affects": {
       "vendor": {
@@ -13,12 +13,12 @@
                "product": {
                   "product_data": [
                      {
-                        "product_name": "Open Build Service",
+                        "product_name": "obs-service-set_version",
                         "version": {
                            "version_data": [
                               {
                                  "affected": "<",
-                                 "version_value": "2.4.6"
+                                 "version_value": "0.5.3-1.1"
                               }
                            ]
                         }
@@ -30,6 +30,12 @@
          ]
       }
    },
+   "credit": [
+      {
+         "lang": "eng",
+         "value": "Martin Koegler"
+      }
+   ],
    "data_format": "MITRE",
    "data_type": "CVE",
    "data_version": "4.0",
@@ -37,23 +43,23 @@
       "description_data": [
          {
             "lang": "eng",
-            "value": "In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent.\n\n"
+            "value": "The set_version script as shipped with obs-service-set_version is a source validator for the Open Build Service (OBS). In versions prior to 0.5.3-1.1 this script did not properly sanitize the input provided by the user, allowing for code execution on the executing server."
          }
       ]
    },
    "impact": {
       "cvss": {
          "attackComplexity": "LOW",
-         "attackVector": "NETWORK",
+         "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
-         "baseScore": 8.8,
+         "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
-         "privilegesRequired": "NONE",
+         "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
-         "userInteraction": "REQUIRED",
-         "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
+         "userInteraction": "NONE",
+         "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
       }
    },
@@ -63,7 +69,7 @@
             "description": [
                {
                   "lang": "eng",
-                  "value": "CWE-352"
+                  "value": "CWE-78"
                }
             ]
          }
@@ -72,21 +78,23 @@
    "references": {
       "reference_data": [
          {
-            "name": "git commit",
             "refsource": "CONFIRM",
-            "url": "https://github.com/openSUSE/open-build-service/commit/2188c059b67b82171d0e28ef59f77e62d22a09d8"
+            "url": "https://www.suse.com/de-de/security/cve/CVE-2014-0593/"
          },
          {
-            "name": "Bugzilla",
             "refsource": "CONFIRM",
-            "url": "https://bugzilla.suse.com/show_bug.cgi?id=870606"
+            "url": "https://lists.opensuse.org/opensuse-buildservice/2014-03/msg00014.html"
+         },
+         {
+            "refsource": "CONFIRM",
+            "url": "https://github.com/openSUSE/obs-service-set_version/commit/10d5bddcea29f74a175f7f550924bf6407e52e93"
          }
       ]
    },
    "source": {
       "defect": [
-         "870606"
+         "866966"
       ],
-      "discovery": "EXTERNAL"
+      "discovery": "UNKNOWN"
    }
 }

2014/5xxx/CVE-2014-5220.json

@@ -73,8 +73,8 @@
    "references": {
       "reference_data": [
          {
-            "name": " openSUSE Security Update announcement",
-            "refsource": "CONFIRM",
+            "name": "openSUSE-SU-2015:0308",
+            "refsource": "SUSE",
             "url": "https://lists.opensuse.org/opensuse-updates/2015-02/msg00069.html"
          },
          {
@@ -91,4 +91,4 @@
       ],
       "discovery": "EXTERNAL"
    }
-}
+}