<div dir="ltr"><div>Quoting upstream's changelog:<br><br><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote">Fixed bug <a href="http://bugs.php.net/67060">#67060</a> (possible privilege escalation due to insecure default configuration). (CVE-2014-0185))<br>
</blockquote><br></div>Kaplan<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, May 6, 2014 at 12:22 PM, Louis Matthijssen <span dir="ltr"><<a href="mailto:naxiz.m@gmail.com" target="_blank">naxiz.m@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Package: php5-fpm<br>
Version: 5.5.12+dfsg-1<br>
Severity: important<br>
<br>
Dear Maintainer,<br>
<br>
* What led up to the situation?<br>
I upgraded from 5.5.11+dfsg-3 to 5.5.12+dfsg-1 using apt-get upgrade.<br>
There are no changes in the configuration by me.<br>
After each start of php5-fpm, permissions are set to srw-rw---- by default<br>
for /var/run/php5-fpm.sock, causing nginx to get a permission denied error:<br>
[crit] 12317#0: *1140 connect() to unix:/var/run/php5-fpm.sock failed<br>
(13: Permission denied) while connecting to upstream<br>
* What exactly did you do (or not do) that was effective (or<br>
ineffective)?<br>
Using chmod 666 /var/run/php5-fpm.sock.<br>
* What was the outcome of this action?<br>
Permissions are restored.<br>
<br>
-- Package-specific info:<br>
==== Additional PHP 5 information ====<br>
<br>
++++ PHP 5 SAPI (php5query -S): ++++<br>
fpm<br>
<br>
++++ PHP 5 Extensions (php5query -M -v): ++++<br>
pdo (Enabled for fpm by maintainer script)<br>
pdo_mysql (Enabled for fpm by maintainer script)<br>
gd (Enabled for fpm by maintainer script)<br>
opcache (Enabled for fpm by maintainer script)<br>
mysql (Enabled for fpm by maintainer script)<br>
json (Enabled for fpm by maintainer script)<br>
mysqli (Enabled for fpm by maintainer script)<br>
mcrypt (Enabled for fpm by maintainer script)<br>
<br>
++++ Configuration files: ++++<br>
[PHP]<br>
engine = On<br>
short_open_tag = Off<br>
asp_tags = Off<br>
precision = 14<br>
output_buffering = 4096<br>
zlib.output_compression = Off<br>
implicit_flush = Off<br>
unserialize_callback_func =<br>
serialize_precision = 17<br>
disable_functions = pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,<br>
disable_classes =<br>
zend.enable_gc = On<br>
expose_php = On<br>
max_execution_time = 30<br>
max_input_time = 60<br>
memory_limit = 128M<br>
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT<br>
display_errors = Off<br>
display_startup_errors = Off<br>
log_errors = On<br>
log_errors_max_len = 1024<br>
ignore_repeated_errors = Off<br>
ignore_repeated_source = Off<br>
report_memleaks = On<br>
track_errors = Off<br>
html_errors = On<br>
variables_order = "GPCS"<br>
request_order = "GP"<br>
register_argc_argv = Off<br>
auto_globals_jit = On<br>
post_max_size = 8M<br>
auto_prepend_file =<br>
auto_append_file =<br>
default_mimetype = "text/html"<br>
doc_root =<br>
user_dir =<br>
enable_dl = Off<br>
file_uploads = On<br>
upload_max_filesize = 2M<br>
max_file_uploads = 20<br>
allow_url_fopen = On<br>
allow_url_include = Off<br>
default_socket_timeout = 60<br>
[CLI Server]<br>
cli_server.color = On<br>
[Date]<br>
[filter]<br>
[iconv]<br>
[intl]<br>
[sqlite]<br>
[sqlite3]<br>
[Pcre]<br>
[Pdo]<br>
[Pdo_mysql]<br>
pdo_mysql.cache_size = 2000<br>
pdo_mysql.default_socket=<br>
[Phar]<br>
[mail function]<br>
SMTP = localhost<br>
smtp_port = 25<br>
mail.add_x_header = On<br>
[SQL]<br>
sql.safe_mode = Off<br>
[ODBC]<br>
odbc.allow_persistent = On<br>
odbc.check_persistent = On<br>
odbc.max_persistent = -1<br>
odbc.max_links = -1<br>
odbc.defaultlrl = 4096<br>
odbc.defaultbinmode = 1<br>
[Interbase]<br>
ibase.allow_persistent = 1<br>
ibase.max_persistent = -1<br>
ibase.max_links = -1<br>
ibase.timestampformat = "%Y-%m-%d %H:%M:%S"<br>
ibase.dateformat = "%Y-%m-%d"<br>
ibase.timeformat = "%H:%M:%S"<br>
[MySQL]<br>
mysql.allow_local_infile = On<br>
mysql.allow_persistent = On<br>
mysql.cache_size = 2000<br>
mysql.max_persistent = -1<br>
mysql.max_links = -1<br>
mysql.default_port =<br>
mysql.default_socket =<br>
mysql.default_host =<br>
mysql.default_user =<br>
mysql.default_password =<br>
mysql.connect_timeout = 60<br>
mysql.trace_mode = Off<br>
[MySQLi]<br>
mysqli.max_persistent = -1<br>
mysqli.allow_persistent = On<br>
mysqli.max_links = -1<br>
mysqli.cache_size = 2000<br>
mysqli.default_port = 3306<br>
mysqli.default_socket =<br>
mysqli.default_host =<br>
mysqli.default_user =<br>
mysqli.default_pw =<br>
mysqli.reconnect = Off<br>
[mysqlnd]<br>
mysqlnd.collect_statistics = On<br>
mysqlnd.collect_memory_statistics = Off<br>
[OCI8]<br>
[PostgreSQL]<br>
pgsql.allow_persistent = On<br>
pgsql.auto_reset_persistent = Off<br>
pgsql.max_persistent = -1<br>
pgsql.max_links = -1<br>
pgsql.ignore_notice = 0<br>
pgsql.log_notice = 0<br>
[Sybase-CT]<br>
sybct.allow_persistent = On<br>
sybct.max_persistent = -1<br>
sybct.max_links = -1<br>
sybct.min_server_severity = 10<br>
sybct.min_client_severity = 10<br>
[bcmath]<br>
bcmath.scale = 0<br>
[browscap]<br>
[Session]<br>
session.save_handler = files<br>
session.use_strict_mode = 0<br>
session.use_cookies = 1<br>
session.use_only_cookies = 1<br>
<a href="http://session.name" target="_blank">session.name</a> = PHPSESSID<br>
session.auto_start = 0<br>
session.cookie_lifetime = 0<br>
session.cookie_path = /<br>
session.cookie_domain =<br>
session.cookie_httponly =<br>
session.serialize_handler = php<br>
session.gc_probability = 0<br>
session.gc_divisor = 1000<br>
session.gc_maxlifetime = 1440<br>
session.referer_check =<br>
session.cache_limiter = nocache<br>
session.cache_expire = 180<br>
session.use_trans_sid = 0<br>
session.hash_function = 0<br>
session.hash_bits_per_character = 5<br>
url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry"<br>
[MSSQL]<br>
mssql.allow_persistent = On<br>
mssql.max_persistent = -1<br>
mssql.max_links = -1<br>
mssql.min_error_severity = 10<br>
mssql.min_message_severity = 10<br>
mssql.compatibility_mode = Off<br>
mssql.secure_connection = Off<br>
[Assertion]<br>
[COM]<br>
[mbstring]<br>
[gd]<br>
[exif]<br>
[Tidy]<br>
tidy.clean_output = Off<br>
[soap]<br>
soap.wsdl_cache_enabled=1<br>
soap.wsdl_cache_dir="/tmp"<br>
soap.wsdl_cache_ttl=86400<br>
soap.wsdl_cache_limit = 5<br>
[sysvshm]<br>
[ldap]<br>
ldap.max_links = -1<br>
[mcrypt]<br>
[dba]<br>
[opcache]<br>
[curl]<br>
<br>
**** /etc/php5/fpm/conf.d/10-pdo.ini ****<br>
extension=pdo.so<br>
<br>
**** /etc/php5/fpm/conf.d/20-gd.ini ****<br>
extension=gd.so<br>
<br>
**** /etc/php5/fpm/conf.d/20-mysqli.ini ****<br>
extension=mysqli.so<br>
<br>
**** /etc/php5/fpm/conf.d/20-mcrypt.ini ****<br>
extension=mcrypt.so<br>
<br>
**** /etc/php5/fpm/conf.d/20-pdo_mysql.ini ****<br>
extension=pdo_mysql.so<br>
<br>
**** /etc/php5/fpm/conf.d/05-opcache.ini ****<br>
zend_extension=opcache.so<br>
<br>
**** /etc/php5/fpm/conf.d/20-mysql.ini ****<br>
extension=mysql.so<br>
<br>
**** /etc/php5/fpm/conf.d/20-json.ini ****<br>
extension=json.so<br>
<br>
<br>
-- System Information:<br>
Debian Release: jessie/sid<br>
APT prefers unstable<br>
APT policy: (500, 'unstable')<br>
Architecture: amd64 (x86_64)<br>
<br>
Kernel: Linux 3.14-1-amd64 (SMP w/1 CPU core)<br>
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)<br>
Shell: /bin/sh linked to /bin/dash<br>
<br>
Versions of packages php5-fpm depends on:<br>
ii dpkg 1.17.9<br>
ii init-system-helpers 1.18<br>
ii libbz2-1.0 1.0.6-5<br>
ii libc6 2.18-5<br>
ii libcomerr2 1.42.9-3<br>
ii libdb5.3 5.3.28-3<br>
ii libgssapi-krb5-2 1.12.1+dfsg-1<br>
ii libk5crypto3 1.12.1+dfsg-1<br>
ii libkrb5-3 1.12.1+dfsg-1<br>
ii libmagic1 1:5.18-1<br>
ii libonig2 5.9.1-1<br>
ii libpcre3 1:8.31-5<br>
ii libqdbm14 1.8.78-3+b1<br>
ii libssl1.0.0 1.0.1g-3<br>
ii libsystemd-daemon0 204-10<br>
ii libxml2 2.9.1+dfsg1-3<br>
ii mime-support 3.54<br>
ii php5-common 5.5.12+dfsg-1<br>
ii php5-json 1.3.5-1<br>
ii tzdata 2014b-1<br>
ii ucf 3.0028<br>
ii zlib1g 1:1.2.8.dfsg-1<br>
<br>
php5-fpm recommends no packages.<br>
<br>
Versions of packages php5-fpm suggests:<br>
pn php-pear <none><br>
<br>
Versions of packages php5-common depends on:<br>
ii libc6 2.18-5<br>
ii lsof 4.86+dfsg-1<br>
ii psmisc 22.21-2<br>
ii sed 4.2.2-4<br>
ii ucf 3.0028<br>
<br>
Versions of packages php5-common suggests:<br>
pn php5-user-cache <none><br>
<br>
-- no debconf information<br>
<br>
_______________________________________________<br>
pkg-php-maint mailing list<br>
<a href="mailto:pkg-php-maint@lists.alioth.debian.org">pkg-php-maint@lists.alioth.debian.org</a><br>
<a href="http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-php-maint" target="_blank">http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-php-maint</a><br>
</blockquote></div><br></div>