CVE-2015-5723
High
Description
Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.
SeverityHigh
CVSS7.8
Exploit probability32. percentile0.4%
Product
Doctrine-project Common
PublishedJun 7, 2016
First seenJun 7, 2016
How to fix
Update
- doctrine/annotations1.2.7 or later
- doctrine/cache1.4.2, 1.3.2 or later
- doctrine/common2.4.3, 2.5.1 or later
- doctrine/orm2.5.1 or later
- doctrine/mongodb-odm1.0.2 or later
- doctrine/mongodb-odm-bundle3.0.1 or later
- zendframework/zendframework11.12.16 or later
- zendframework/zend-cache2.5.3, 2.4.8 or later
- aws/aws-sdk-php3.2.1 or later
- zendframework/zendframework2.4.8 or later
- zfcampus/zf-apigility-doctrine1.0.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| doctrine-project common | v ≤ 2.4.2, 2.5.0 | — |
| zend zend-cache | v ≤ 2.4.7, 2.5.0, 2.5.1, 2.5.2 | — |
| debian debian_linux | 7.0, 8.0 | — |
| doctrine-project object_relational_mapper | v ≤ 2.4.7, 2.5.0 | — |
| doctrine-project doctrinemongodbbundle | 3.0.0 | — |
| zend zend_framework | v ≤ 2.4.7, v ≤ 1.12.15 | — |
| doctrine-project annotations | v ≤ 1.2.6 | — |
| doctrine-project mongodb-odm | v ≤ 1.0.1 | — |
| doctrine-project cache | v ≤ 1.3.1, 1.4.0, 1.4.1 | — |
| zend zf-apigility-doctrine | v ≤ 1.0.2 | — |
| doctrine/annotationsPackagist | v < 1.2.7 | 1.2.7 |
| doctrine/cachePackagist | 1.4.0 ≤ v < 1.4.2, 1.0.0 ≤ v < 1.3.2 | 1.4.2, 1.3.2 |
| doctrine/commonPackagist | v < 2.4.3, 2.5.0-stable ≤ v < 2.5.1 | 2.4.3, 2.5.1 |
| doctrine/ormPackagist | 2.5.0 ≤ v < 2.5.1 | 2.5.1 |
| doctrine/mongodb-odmPackagist | v < 1.0.2 | 1.0.2 |
| doctrine/mongodb-odm-bundlePackagist | v < 3.0.1 | 3.0.1 |
| zendframework/zendframework1Packagist | 1.12.0 ≤ v < 1.12.16 | 1.12.16 |
| zendframework/zend-cachePackagist | 2.5.0 ≤ v < 2.5.3, 2.4.0 ≤ v < 2.4.8 | 2.5.3, 2.4.8 |
| aws/aws-sdk-phpPackagist | 3.0.0 ≤ v < 3.2.1 | 3.2.1 |
| zendframework/zendframeworkPackagist | 2.4.0 ≤ v < 2.4.8 | 2.4.8 |
| zfcampus/zf-apigility-doctrinePackagist | 1.0.0 ≤ v < 1.0.3 | 1.0.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.