Bug 1347924

Summary:	CVE-2015-5723 php-doctrine-common filesystem permission issues
Product:	[Fedora] Fedora EPEL	Reporter:	David Eisenstein <deisenst2>
Component:	php-doctrine-common	Assignee:	Shawn Iwinski <shawn>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	el6	CC:	deisenst2, shawn
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	php-doctrine-common-2.5.3-1.fc24 php-doctrine-common-2.5.3-1.fc23 php-doctrine-common-2.5.3-1.el7 php-doctrine-common-2.4.3-2.el6	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	1347926 (view as bug list)		Environment:
Last Closed:	2016-08-01 16:27:18 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description David Eisenstein 2016-06-18 13:28:15 UTC

Description of problem:
Doctrine Common before 2.4.3 and 2.5.x before 2.5.1 uses world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.

Version-Release number of selected component (if applicable):
php-doctrine-common-2.4.2-3.el6

See:  http://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html

Comment 1 Fedora Update System 2016-07-22 18:59:29 UTC

php-doctrine-common-2.5.3-1.el7 has been submitted as an update to Fedora EPEL 7. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-76bb0cb040

Comment 2 Fedora Update System 2016-07-22 18:59:35 UTC

php-doctrine-common-2.5.3-1.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-8dc0af2c29

Comment 3 Fedora Update System 2016-07-22 18:59:39 UTC

php-doctrine-common-2.5.3-1.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-fa7e683c6e

Comment 4 Fedora Update System 2016-07-22 21:38:58 UTC

php-doctrine-orm-2.4.8-1.el6 php-doctrine-dbal-2.4.5-1.el6 php-doctrine-common-2.4.3-2.el6 has been submitted as an update to Fedora EPEL 6. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-823164477b

Comment 5 Fedora Update System 2016-07-23 21:18:39 UTC

php-doctrine-common-2.4.3-2.el6, php-doctrine-dbal-2.4.5-1.el6, php-doctrine-orm-2.4.8-1.el6 has been pushed to the Fedora EPEL 6 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-823164477b

Comment 6 Fedora Update System 2016-07-23 21:46:29 UTC

php-doctrine-common-2.5.3-1.el7 has been pushed to the Fedora EPEL 7 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-76bb0cb040

Comment 7 Fedora Update System 2016-07-23 22:18:06 UTC

php-doctrine-common-2.5.3-1.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-8dc0af2c29

Comment 8 Fedora Update System 2016-07-23 22:21:47 UTC

php-doctrine-common-2.5.3-1.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-fa7e683c6e

Comment 9 Fedora Update System 2016-08-01 16:27:17 UTC

php-doctrine-common-2.5.3-1.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2016-08-01 18:53:00 UTC

php-doctrine-common-2.5.3-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2016-08-08 21:18:01 UTC

php-doctrine-common-2.5.3-1.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2016-08-08 21:48:48 UTC

php-doctrine-common-2.4.3-2.el6, php-doctrine-dbal-2.4.5-1.el6, php-doctrine-orm-2.4.8-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.