{"id":"CVE-2014-0185","aliases":["DSA-2943-1","EUVD-2014-0237","GHSA-g7xr-pqqf-vpjw","MGASA-2014-0215","UBUNTU-CVE-2014-0185","USN-2254-1","openSUSE-SU-2024:10290-1","openSUSE-SU-2024:10344-1","openSUSE-SU-2024:10487-1","openSUSE-SU-2024:11169-1"],"status":"published","title":"sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x...","description":"sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client.","severity":{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00485,"percentile":0.42011,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269"],"published":"2014-05-06T00:00:00Z","modified":"2026-06-17T00:02:27Z","fixes":[{"ecosystem":"Mageia:3","package":"php","fixed_in":["5.4.28-1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"php-gd-bundled","fixed_in":["5.4.28-1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"php-apc","fixed_in":["3.1.14-7.8.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"php-suhosin","fixed_in":["0.9.35-1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"php-timezonedb","fixed_in":["2014.3-1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"php","fixed_in":["5.5.12-1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"php-apc","fixed_in":["3.1.15-4.3.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"php-suhosin","fixed_in":["0.9.35-1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"php-timezonedb","fixed_in":["2014.3-1.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"php5","fixed_in":["5.5.9+dfsg-1ubuntu4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"froxlor","fixed_in":["0.9.38.4-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:7","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.4-14+deb7u10"}]}],"versions":["5.4.4-14","5.4.4-14+deb7u1","5.4.4-14+deb7u2","5.4.4-14+deb7u3","5.4.4-14+deb7u4","5.4.4-14+deb7u5","5.4.4-14+deb7u7","5.4.4-14+deb7u8","5.4.4-14+deb7u9"],"bundled":4},{"source":"osv","ecosystem":"Mageia:3","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.28-1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"php-gd-bundled","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.28-1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"php-apc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-7.8.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"php-suhosin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.35-1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"php-timezonedb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.3-1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.12-1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"php-apc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.15-4.3.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"php-suhosin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.35-1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"php-timezonedb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.3-1.mga4"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.9+dfsg-1ubuntu4.1"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.9+dfsg-1ubuntu4.1"}]}],"versions":["5.5.3+dfsg-1ubuntu2","5.5.3+dfsg-1ubuntu3","5.5.6+dfsg-1ubuntu1","5.5.6+dfsg-1ubuntu2","5.5.8+dfsg-2ubuntu1","5.5.9+dfsg-1ubuntu1","5.5.9+dfsg-1ubuntu2","5.5.9+dfsg-1ubuntu3","5.5.9+dfsg-1ubuntu4"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.14-1.4"}]}],"bundled":70},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"php5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.28-1.1"}]}],"bundled":71},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"froxlor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.38.4-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"php8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.11-1.1"}]}],"bundled":97}],"products":[{"vendor":"php","product":"php"}],"references":[{"url":"http://secunia.com/advisories/59329","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"https://github.com/php/php-src/commit/35ceea928b12373a3b1e3eecdc32ed323223a40d","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Third Party Advisory"]},{"url":"https://hoffmann-christian.info/files/php-fpm/0001-Fix-bug-67060-use-default-mode-of-660.patch","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1307027","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"https://bugs.php.net/bug.php?id=67060","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://secunia.com/advisories/59061","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory"]},{"url":"http://www.php.net/ChangeLog-5.php","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.php.net/archive/2014.php#id2014-05-01-1","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://support.apple.com/kb/HT6443","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2014/04/29/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1092815","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-10/msg00012.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0185"},{"url":"https://github.com/advisories/GHSA-g7xr-pqqf-vpjw"},{"url":"https://advisories.mageia.org/MGASA-2014-0215.html","tags":["advisory"]},{"url":"http://openwall.com/lists/oss-security/2014/04/29/5","tags":["web"]},{"url":"http://www.php.net/ChangeLog-5.php#5.4.28","tags":["web"]},{"url":"http://www.php.net/ChangeLog-5.php#5.5.12","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-May/132546.html","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13290","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0185","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2254-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0238","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-4049","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-7243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-4150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-4645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2305","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2326","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2005-3353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2005-3388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2005-3389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2005-3390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2005-3391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2005-3392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-0996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-0599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11036","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21706","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-0185","description":"sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client.","status":"published","published":"2014-05-06T10:00:00Z","modified":"2024-08-06T09:05:39.28Z","updated_at":"2026-11-02T14:33:47.741012Z"}],"euvd":[{"id":"EUVD-2014-0237","description":"sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client.","status":"published","published":"2014-05-06T10:00:00Z","modified":"2024-08-06T09:05:39Z","updated_at":"2026-11-03T01:57:22.468358Z"}],"ghsa":[{"id":"GHSA-g7xr-pqqf-vpjw","title":"sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x...","description":"sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client.","status":"published","published":"2022-05-17T03:07:04Z","modified":"2023-01-28T05:01:15Z","cwes":["CWE-269"],"updated_at":"2026-11-02T14:43:31.850485Z"}],"nvd":[{"id":"CVE-2014-0185","description":"sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client.","status":"published","published":"2014-05-06T10:44:02.987Z","modified":"2026-06-17T00:02:27.577Z","cvss":[{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:02:54.082915Z"}],"osv":[{"id":"DSA-2943-1","title":"php5 - security update","status":"published","published":"2014-06-01T00:00:00Z","modified":"2026-03-09T01:20:16.51377Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0215","title":"Updated php packages fix CVE-2014-0185","description":"Updated php packages fix security vulnerability:\n\nPHP FPM in PHP versions before 5.4.28 and 5.5.12 uses a UNIX domain socket\nwith world-writable permissions by default, which allows any local user to\nconnect to it and execute PHP scripts as the apache user (CVE-2014-0185).\n\nAdditionally updated php-suhosin package corrects an issue which could \ncause a segfault in apache. Also updated is php-timezonedb.\n","status":"published","published":"2014-05-14T22:02:58Z","modified":"2026-04-16T06:26:12.342033062Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10290-1","title":"apache2-mod_php7-7.0.14-1.4 on GA media","description":"These are all security issues fixed in the apache2-mod_php7-7.0.14-1.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:00:03.261343Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10344-1","title":"apache2-mod_php5-5.6.28-1.1 on GA media","description":"These are all security issues fixed in the apache2-mod_php5-5.6.28-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:58:15.40421Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:10487-1","title":"froxlor-0.9.38.4-1.1 on GA media","description":"These are all security issues fixed in the froxlor-0.9.38.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:51:49.501226Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:11169-1","title":"php8-8.0.11-1.1 on GA media","description":"These are all security issues fixed in the php8-8.0.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:14:38.718583Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"UBUNTU-CVE-2014-0185","description":"sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client.","status":"published","published":"2014-05-06T00:00:00Z","modified":"2026-04-22T09:27:54.033039Z","updated_at":"2026-11-02T15:54:07.855521Z"},{"id":"USN-2254-1","title":"php5 vulnerabilities","description":"Christian Hoffmann discovered that the PHP FastCGI Process Manager (FPM)\nset incorrect permissions on the UNIX socket. A local attacker could use\nthis issue to possibly elevate their privileges. This issue only affected\nUbuntu 12.04 LTS, Ubuntu 13.10, and Ubuntu 14.04 LTS. (CVE-2014-0185)\n\nFrancisco Alonso discovered that the PHP Fileinfo component incorrectly\nhandled certain CDF documents. A remote attacker could use this issue to\ncause PHP to hang or crash, resulting in a denial of service.\n(CVE-2014-0237, CVE-2014-0238)\n\nStefan Esser discovered that PHP incorrectly handled DNS TXT records. A\nremote attacker could use this issue to cause PHP to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2014-4049)\n","status":"published","published":"2014-06-23T12:05:29Z","modified":"2026-04-22T08:54:03.267882Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}