Bugzilla (bugzilla.redhat.com) will be under maintenance for infrastructure upgrades and will not be available on July 31st between 12:30 AM - 05:30 AM UTC. We appreciate your understanding and patience. You can follow status.redhat.com for details.
Bug 1269077 (CVE-2015-5723) - CVE-2015-5723 php-ZendFramework: filesystem permissions issues in multiple components (ZF2015-07)
Summary: CVE-2015-5723 php-ZendFramework: filesystem permissions issues in multiple co...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: CVE-2015-5723
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1269079 1269080 1269081
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-10-06 09:19 UTC by Martin Prpič
Modified: 2021-02-17 04:52 UTC (History)
5 users (show)

Fixed In Version: Zend Framework 1.12.16, Zend Framework 2.4.8
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-08-09 07:13:57 UTC


Attachments (Terms of Use)

Description Martin Prpič 2015-10-06 09:19:39 UTC
It was reported that incorrect permissions masks when creating a new directory or file can lead to local arbitrary code execution or privilege escalation.

This issue has been fixed in upstream versions 1.12.16 and 2.4.8.

External References:

http://framework.zend.com/security/advisory/ZF2015-07

Comment 1 Martin Prpič 2015-10-06 09:24:10 UTC
Created php-ZendFramework2 tracking bugs for this issue:

Affects: epel-6 [bug 1269079]

Comment 2 Martin Prpič 2015-10-06 09:24:13 UTC
Created php-ZendFramework tracking bugs for this issue:

Affects: epel-all [bug 1269080]
Affects: fedora-all [bug 1269081]

Comment 3 Fedora Update System 2016-08-08 21:48:18 UTC
php-ZendFramework2-2.2.10-2.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.

Comment 4 Shawn Iwinski 2016-08-09 01:46:51 UTC
All dependent bugs closed


Note You need to log in before you can comment on or make changes to this bug.