Bug 1269077 (CVE-2015-5723) - CVE-2015-5723 php-ZendFramework: filesystem permissions issues in multiple components (ZF2015-07)
Summary: CVE-2015-5723 php-ZendFramework: filesystem permissions issues in multiple co...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: CVE-2015-5723
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1269079 1269080 1269081
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-10-06 09:19 UTC by Martin Prpič
Modified: 2021-02-17 04:52 UTC (History)
5 users (show)

Fixed In Version: Zend Framework 1.12.16, Zend Framework 2.4.8
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-08-09 07:13:57 UTC

Attachments (Terms of Use)

Description Martin Prpič 2015-10-06 09:19:39 UTC 
It was reported that incorrect permissions masks when creating a new directory or file can lead to local arbitrary code execution or privilege escalation.

This issue has been fixed in upstream versions 1.12.16 and 2.4.8.

External References:

http://framework.zend.com/security/advisory/ZF2015-07
Comment 1 Martin Prpič 2015-10-06 09:24:10 UTC 
Created php-ZendFramework2 tracking bugs for this issue:

Affects: epel-6 [bug 1269079]
Comment 2 Martin Prpič 2015-10-06 09:24:13 UTC 
Created php-ZendFramework tracking bugs for this issue:

Affects: epel-all [bug 1269080]
Affects: fedora-all [bug 1269081]
Comment 3 Fedora Update System 2016-08-08 21:48:18 UTC 
php-ZendFramework2-2.2.10-2.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
Comment 4 Shawn Iwinski 2016-08-09 01:46:51 UTC 
All dependent bugs closed
Note You need to log in before you can comment on or make changes to this bug.