~ / search / GHSA-pw5c-xqf2-6xc2

GHSA-pw5c-xqf2-6xc2

Doctrine Security Misconfiguration Vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2015-5723

Packages

EcosystemPackageAffectedFixed in
Packagist doctrine/annotations < 1.2.7 1.2.7
Packagist doctrine/cache >= 1.4.0, < 1.4.2 1.4.2
Packagist doctrine/common < 2.4.3 2.4.3
Packagist doctrine/common >= 2.5.0-stable, < 2.5.1 2.5.1
Packagist doctrine/orm >= 2.5.0, < 2.5.1 2.5.1
Packagist doctrine/mongodb-odm < 1.0.2 1.0.2
Packagist doctrine/mongodb-odm-bundle < 3.0.1 3.0.1
Packagist zendframework/zendframework1 >= 1.12.0, < 1.12.16 1.12.16
Packagist zendframework/zend-cache >= 2.5.0, < 2.5.3 2.5.3
Packagist aws/aws-sdk-php >= 3.0.0, < 3.2.1 3.2.1
Packagist doctrine/cache >= 1.0.0, < 1.3.2 1.3.2
Packagist zendframework/zend-cache >= 2.4.0, < 2.4.8 2.4.8
Packagist zendframework/zendframework >= 2.4.0, < 2.4.8 2.4.8
Packagist zfcampus/zf-apigility-doctrine >= 1.0.0, < 1.0.3 1.0.3

Details

As written in the advisory (Markdown source, shown as plain text).

Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.

References

External links from the advisory. They lead to third-party sites.