Lucene search

K
osvGoogleOSV:DSA-2943-1
HistoryJun 01, 2014 - 12:00 a.m.

php5 - security update

2014-06-0100:00:00
Google
osv.dev
17

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

Several vulnerabilities were found in PHP, a general-purpose scripting
language commonly used for web application development:

  • CVE-2014-0185
    The default PHP FPM socket permission has been changed from 0666
    to 0660 to mitigate a security vulnerability
    (
    CVE-2014-0185
    ) in PHP FPM that allowed any local user to run a PHP code
    under the active user of FPM process via crafted FastCGI client.

The default Debian setup now correctly sets the listen.owner and
listen.group to www-data:www-data in default php-fpm.conf. If you
have more FPM instances or a webserver not running under www-data
user you need to adjust the configuration of FPM pools in
/etc/php5/fpm/pool.d/ so the accessing process has rights to
access the socket.

For the stable distribution (wheezy), these problems have been fixed in
version 5.4.4-14+deb7u10.

For the unstable distribution (sid), these problems will be fixed soon.

We recommend that you upgrade your php5 packages.

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C