Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.

### v2.5.3

#### Bug-fixes

  - \#367: Fix how namespace matching happens in     SymfonyFileLocator

### v2.5.2

#### Bug-fixes

  - DCOM-299 #383 Silence chmod() warnings

  - DCOM-301 #384 Fixed bug with getAllClassNames() in     subdirectories

  - DCOM-303 #387 Fixed fatal error in     AbstractManagerRegistry

#### Improvement

  - DCOM-289 #373 composer: bump to PHPUnit 4.7

### v2.5.1

  -     [CVE-2015-5723](http://www.doctrine-project.org/2015/08/     31/security_misconfiguration_vulnerability_in_various_do     ctrine_projects.html)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

## v2.4.8

### Security

  - CVE-2015-5723 php-doctrine-orm filesystem permission     issues

    - https://access.redhat.com/security/cve/CVE-2015-5723

    - http://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html

### Bug

  - [DDC-3310] - [GH-1138] Join column index names

  - [DDC-3343] - `PersistentCollection::removeElement`     schedules an entity for deletion when relationship is     EXTRA_LAZY, with `orphanRemoval` false.

  - [DDC-3464] - [GH-1231] Backport 'Merge pull request     #1098 from encoder32/DDC-1590' to 2.4 branch

  - [DDC-3482] - [GH-1242] Attempting to lock a proxy object     fails as UOW doesn't init proxy first

  - [DDC-3493] - New (PHP 5.5) 'class' keyword - wrong     parsing by EntityGenerator

  - [DDC-3494] - [GH-1250] Test case for 'class' keyword

  - [DDC-3500] - [GH-1254] Fix applying ON/WITH conditions     to first join in Class Table Inheritance

  - [DDC-3502] - [GH-1256] DDC-3493 - fixed EntityGenerator     parsing for php 5.5 '::class' syntax

  - [DDC-3518] - [GH-1266] [2.4] Fix schema generation in     the test suite

  - [DDC-3537] - [GH-1282] Hotfix/#1169 extra lazy one to     many should not delete referenced entities (backport to     2.4)

  - [DDC-3551] - [GH-1294] Avoid Connection error when     calling ClassMetadataFactor::getAllMetadata()

  - [DDC-3560] - [GH-1300] [2.4] #1169 DDC-3343 one-to-omany     persister deletes only on EXTRA_LAZY plus orphanRemoval

  - [DDC-3608] - [GH-1327] Properly generate default value     from yml & xml mapping

  - [DDC-3619] - spl_object_hash collision

  - [DDC-3624] - [GH-1338] [DDC-3619] Update identityMap     when entity gets managed again

  - [DDC-3643] - [GH-1352] fix EntityGenerator     RegenerateEntityIfExists

### Improvement

  - [DDC-3530] - [GH-1276] travis: run coverage just once

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 1.12.16 - fixes CVE-2015-5161:
http://framework.zend.com/security/advisory/ZF2015-06 - fixes CVE-2015-5723: http://framework.zend.com/security/advisory/ZF2015-07 - removed services: DeveloperGarden, Technorati

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities were discovered in Zend Framework, a PHP framework :

  - CVE-2015-5723     It was discovered that due to incorrect permissions     masks when creating directories, local attackers could     potentially execute arbitrary code or escalate     privileges.

  - ZF2015-08 (no CVE assigned)

    Chris Kings-Lynne discovered a SQL injection vector     caused by missing null byte filtering in the MS SQL PDO     backend, and a similar issue was also found in the     SQLite backend.

ID	Name	Product	Family	Severity
92673	Fedora 24 : php-doctrine-common (2016-fa7e683c6e)	Nessus	Fedora Local Security Checks	high
92671	Fedora 23 : php-doctrine-common (2016-8dc0af2c29)	Nessus	Fedora Local Security Checks	high
92447	Fedora 24 : php-doctrine-orm (2016-f0c8b7b115)	Nessus	Fedora Local Security Checks	high
92445	Fedora 23 : php-doctrine-orm (2016-7e229134f9)	Nessus	Fedora Local Security Checks	high
89458	Fedora 21 : php-ZendFramework-1.12.16-1.fc21 (2015-f1e18131bc)	Nessus	Fedora Local Security Checks	high
89271	Fedora 22 : php-ZendFramework-1.12.16-1.fc22 (2015-6d70a701bf)	Nessus	Fedora Local Security Checks	high
89193	Fedora 23 : php-ZendFramework-1.12.16-1.fc23 (2015-2e7c06c639)	Nessus	Fedora Local Security Checks	high
86303	Debian DSA-3369-1 : zendframework - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2015-5723

high

Tenable Plugins

high

high

high

high

high

high

high

critical