Bug 202386

Summary: security/vuxml: document and MFH lang/php5 {55,56} recent vulnerability fixes
Product: Ports & Packages Reporter: Jason Unovitch <junovitch>
Component: Individual Port(s)Assignee: Jason Unovitch <junovitch>
Status: Closed FIXED    
Severity: Affects Some People CC: ale, ports-secteam
Priority: --- Keywords: security
Version: Latest   
Hardware: Any   
OS: Any   
URL: http://php.net/ChangeLog-5.php
Attachments:
Description Flags
security/vuxml for 5.4.44, 5.5.28, and 5.6.12 (http://php.net/ChangeLog-5.php) none

Description Jason Unovitch freebsd_committer freebsd_triage 2015-08-17 13:04:44 UTC 
Created attachment 159952 [details]
security/vuxml for 5.4.44, 5.5.28, and 5.6.12 (http://php.net/ChangeLog-5.php)

Document PHP security issues impacting the lang/php5* ports (Core/SPL) and 3 extensions(OpenSSL, Phar, SOAP)


% make validate
/bin/sh /usr/ports/security/vuxml/files/tidy.sh "/usr/ports/security/vuxml/files/tidy.xsl" "/usr/ports/security/vuxml/vuln.xml" > "/usr/ports/security/vuxml/vuln.xml.tidy"
>>> Validating...
/usr/local/bin/xmllint --valid --noout /usr/ports/security/vuxml/vuln.xml
>>> Successful.
Checking if tidy differs...
... seems okay
Checking for space/tab...
... seems okay
/usr/local/bin/python2.7 /usr/ports/security/vuxml/files/extra-validation.py /usr/ports/security/vuxml/vuln.xml

% env PKG_DBDIR=/usr/ports/security/vuxml pkg audit php56-5.6.11
php56-5.6.11 is vulnerable:
php5 -- multiple vulnerabilities
WWW: https://vuxml.FreeBSD.org/freebsd/787ef75e-44da-11e5-93ad-002590263bf5.html

1 problem(s) in the installed packages found.

% env PKG_DBDIR=/usr/ports/security/vuxml pkg audit php56-5.6.12
0 problem(s) in the installed packages found.
Comment 1 commit-hook freebsd_committer freebsd_triage 2015-08-17 13:45:54 UTC 
A commit references this bug:

Author: junovitch
Date: Mon Aug 17 13:44:56 UTC 2015
New revision: 394504
URL: https://svnweb.freebsd.org/changeset/ports/394504

Log:
  Document PHP security issues impacting the lang/php5* ports (Core/SPL)
  and 3 extensions (OpenSSL, Phar, SOAP)

  PR:		202386
  Security:	787ef75e-44da-11e5-93ad-002590263bf5
  Approved by:	feld (mentor)

Changes:
  head/security/vuxml/vuln.xml
Comment 2 Jason Unovitch freebsd_committer freebsd_triage 2015-08-17 15:27:51 UTC 
Issue documented and the port security updates have all been MFH'd to 2015Q3.  No further actions to be taken for this update.

https://svnweb.FreeBSD.org/changeset/ports/394512
https://svnweb.FreeBSD.org/changeset/ports/394513
https://svnweb.FreeBSD.org/changeset/ports/394514