diff options
| author | bdrewery <bdrewery@FreeBSD.org> | 2013-07-23 18:32:22 +0800 |
|---|---|---|
| committer | bdrewery <bdrewery@FreeBSD.org> | 2013-07-23 18:32:22 +0800 |
| commit | 4903e837aa67100c8fcdfcf63148750aac1f88bb (patch) | |
| tree | 4d7d16af5a3babc191f96acc216d67fee26100b1 /security | |
| parent | 9cadb26e6160b9597630e2eaffe27a728b931956 (diff) | |
| download | freebsd-ports-gnome-4903e837aa67100c8fcdfcf63148750aac1f88bb.tar.gz freebsd-ports-gnome-4903e837aa67100c8fcdfcf63148750aac1f88bb.tar.zst freebsd-ports-gnome-4903e837aa67100c8fcdfcf63148750aac1f88bb.zip | |
- Update whitespace for 2fbfd455-f2d0-11e2-8a46-000d601460a4
Requested by: remko
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 10 |
1 files changed, 4 insertions, 6 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index fc098cba3542..257faa199010 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -65,14 +65,12 @@ Note: Please add new entries to the beginning of this file. <blockquote cite="https://lists.marsching.com/pipermail/suphp/2013-May/002552.html"> <p>When the suPHP_PHPPath was set, mod_suphp would use the specified PHP executable to pretty-print PHP source files (MIME type - x-httpd-php-source or application/x-httpd-php-source). - - However, it would not sanitize the environment. Thus a user that was + x-httpd-php-source or application/x-httpd-php-source).</p> + <p>However, it would not sanitize the environment. Thus a user that was allowed to use the SetEnv directive in a .htaccess file (AllowOverride FileInfo) could make PHP load a malicious configuration file (e.g. - loading malicious extensions). - - As the PHP process for highlighting the source file was run with the + loading malicious extensions).</p> + <p>As the PHP process for highlighting the source file was run with the privileges of the user Apache HTTPd was running as, a local attacker could probably execute arbitrary code with the privileges of this user.</p> </blockquote> |