Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 o

Summary

Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.

Timeline

1. Jun 7, 2016, 2:00 PM UTCCVE published
2. Aug 6, 2024, 6:59 AM UTCRecord last updated

Affected versions

• n/a n/a

  Version range not reported

• doctrine/annotationsPackagist

  fixed in 1.2.7

• doctrine/cachePackagist

  From 1.4.0 · fixed in 1.4.2

• doctrine/commonPackagist

  fixed in 2.4.3

• doctrine/commonPackagist

  From 2.5.0-stable · fixed in 2.5.1

• doctrine/ormPackagist

  From 2.5.0 · fixed in 2.5.1

• doctrine/mongodb-odmPackagist

  fixed in 1.0.2

• doctrine/mongodb-odm-bundlePackagist

  fixed in 3.0.1

• zendframework/zendframework1Packagist

  From 1.12.0 · fixed in 1.12.16

• zendframework/zend-cachePackagist

  From 2.5.0 · fixed in 2.5.3

• aws/aws-sdk-phpPackagist

  From 3.0.0 · fixed in 3.2.1

• doctrine/cachePackagist

  From 1.0.0 · fixed in 1.3.2

• zendframework/zend-cachePackagist

  From 2.4.0 · fixed in 2.4.8

• zendframework/zendframeworkPackagist

  From 2.4.0 · fixed in 2.4.8

• zfcampus/zf-apigility-doctrinePackagist

  From 1.0.0 · fixed in 1.0.3

References 5