CVE-2015-5723

Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.

Affected Software

Name	Vendor	Start Version	End Version
Zend-cache	Zend	*	2.4.7 (including)
Zend-cache	Zend	2.5.0 (including)	2.5.0 (including)
Zend-cache	Zend	2.5.1 (including)	2.5.1 (including)
Zend-cache	Zend	2.5.2 (including)	2.5.2 (including)
Doctrine	Ubuntu	artful	*
Doctrine	Ubuntu	precise	*
Doctrine	Ubuntu	trusty	*
Doctrine	Ubuntu	upstream	*
Doctrine	Ubuntu	vivid	*
Doctrine	Ubuntu	wily	*
Doctrine	Ubuntu	yakkety	*
Doctrine	Ubuntu	zesty	*
Php-doctrine-annotations	Ubuntu	artful	*
Php-doctrine-annotations	Ubuntu	upstream	*
Php-doctrine-annotations	Ubuntu	vivid	*
Php-doctrine-annotations	Ubuntu	wily	*
Php-doctrine-annotations	Ubuntu	yakkety	*
Php-doctrine-annotations	Ubuntu	zesty	*
Php-doctrine-cache	Ubuntu	artful	*
Php-doctrine-cache	Ubuntu	upstream	*
Php-doctrine-cache	Ubuntu	vivid	*
Php-doctrine-cache	Ubuntu	wily	*
Php-doctrine-cache	Ubuntu	yakkety	*
Php-doctrine-cache	Ubuntu	zesty	*
Php-doctrine-common	Ubuntu	artful	*
Php-doctrine-common	Ubuntu	trusty	*
Php-doctrine-common	Ubuntu	upstream	*
Php-doctrine-common	Ubuntu	vivid	*
Php-doctrine-common	Ubuntu	wily	*
Php-doctrine-common	Ubuntu	yakkety	*
Php-doctrine-common	Ubuntu	zesty	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2015-5723
CWE	https://cwe.mitre.org/data/definitions/264.html

Affected Software

References