diff options
| author | Peter Korsgaard <peter@korsgaard.com> | 2018-12-08 00:09:14 +0100 |
|---|---|---|
| committer | Peter Korsgaard <peter@korsgaard.com> | 2018-12-08 10:55:53 +0100 |
| commit | 1af52321389f56cec4888389b2161cc1ee2bfaed (patch) | |
| tree | ab4d31d1a93808fd9b0bbe18aef7847c73b2c3ff /package/qt5/qt5xmlpatterns | |
| parent | 60eb2cec80e5258a0c43090f539749606744e182 (diff) | |
| download | buildroot-1af52321389f56cec4888389b2161cc1ee2bfaed.tar.gz buildroot-1af52321389f56cec4888389b2161cc1ee2bfaed.zip | |
php: security bump to version 7.2.13
Fixes CVE-2018-19518: University of Washington IMAP Toolkit 2007f on UNIX,
as used in imap_open() in PHP and other products, launches an rsh command
(by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen
function in osdep/unix/tcp_unix.c) without preventing argument injection,
which might allow remote attackers to execute arbitrary OS commands if the
IMAP server name is untrusted input (e.g., entered by a user of a web
application) and if rsh has been replaced by a program with different
argument semantics. For example, if rsh is a link to ssh (as seen on Debian
and Ubuntu systems), then the attack can use an IMAP server name containing
a "-oProxyCommand" argument.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Diffstat (limited to 'package/qt5/qt5xmlpatterns')
0 files changed, 0 insertions, 0 deletions
