[ glsa 201910-01 ] php

[GLSA]

Gentoo Linux Security Advisory

Title: PHP: Arbitrary code execution (GLSA 201910-01)
Severity: high
Exploitable: remote
Date: 2019-10-25
Bug(s): #698452
ID: 201910-01

Synopsis

A vulnerability in PHP might allow an attacker to execute arbitrary
code.


Background

PHP is an open source general-purpose scripting language that is
especially suited for web development.


Affected Packages

Package: dev-lang/php
Vulnerable: < 7.1.33
Vulnerable: < 7.2.24
Vulnerable: < 7.3.11
Vulnerable: < 5.6.40-r7
Unaffected: >= 7.1.33
Unaffected: >= 7.2.24
Unaffected: >= 7.3.11
Unaffected: >= 5.6.40-r7
Architectures: All supported architectures


Description

A underflow in env_path_info in PHP-FPM under certain configurations can
be exploited to gain remote code execution.


Impact

A remote attacker, by sending special crafted HTTP requests, could
possibly execute arbitrary code with the privileges of the process, or
cause a Denial of Service condition.


Workaround

If patching is not feasible, the suggested workaround is to include
checks to verify whether or not a file exists before passing to PHP.


Resolution

All PHP 5.6 users should upgrade to the latest version: