Sec Bug->Bug #75968 [Asn->Dup]: php-fpm restarts master process in a loop when using Program execution Function

Edit report at https://bugs.php.net/bug.php?id=75968&edit=1 ID: 75968 Updated by: nikic@php.net Reported by: schnederle at futureweb dot at Summary: php-fpm restarts master process in a loop when using Program execution Function -Status: Assigned +Status: Duplicate -Type: Security +Type: Bug Package: FPM related Operating System: Centos/RHEL 7.4 PHP Version: 7.2.2 Assigned To: bukka Block user comment: N Private report: Y CVE-ID: 2015-9253 New Comment: Duplicate of bug #73342. Unassigning privacy status as this has been public for a long time already. Bug #73342 also has a patch attached, though I haven't checked if it makes sense. Previous Comments: ------------------------------------------------------------------------ [2018-02-23 14:03:57] bukka@php.net This seems just like a duplicate of the https://bugs.php.net/bug.php?id=70185 that is public already so there is no reason to keep this as a security bug IMHO. ------------------------------------------------------------------------ [2018-02-21 13:18:06] cmb@php.net > Could someone explain to me why this is a security issue? Sorry, I can't. I've merely switched to private, since a CVE had been assigned. ------------------------------------------------------------------------ [2018-02-20 23:12:25] stas@php.net I mean, if you have process exec privileges, couldn't you just "kill -9" your parent FPM process from shell and achieve the same effect? ------------------------------------------------------------------------ [2018-02-20 23:11:09] stas@php.net Could someone explain to me why this is a security issue? Which permission border is being crossed? ------------------------------------------------------------------------ [2018-02-20 10:38:45] schnederle at futureweb dot at someone with proper rights please assign CVE-2015-9253 to this Bug Report. Source: - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9253 - https://www.futureweb.at/security/CVE-2015-9253/ ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=75968 -- Edit this bug report at https://bugs.php.net/bug.php?id=75968&edit=1