From 153e8f632a497549bc05324c6078964b433c63b5 Mon Sep 17 00:00:00 2001 From: Remi Collet Date: Wed, 20 Oct 2021 14:08:13 +0200 Subject: refresh patch (with NEWS) --- php-bug81026.patch | 35 ++++++++++++++++++++++++++++++++--- 1 file changed, 32 insertions(+), 3 deletions(-) diff --git a/php-bug81026.patch b/php-bug81026.patch index ed235a8..3bb8cc7 100644 --- a/php-bug81026.patch +++ b/php-bug81026.patch @@ -1,8 +1,8 @@ -From 59246b568fb454eb7097d7d5329bcacf22c0882c Mon Sep 17 00:00:00 2001 +From 7e7f808fbc9a6a5d2eabdd9e7cb058a61f439aee Mon Sep 17 00:00:00 2001 From: Jakub Zelenka Date: Sat, 2 Oct 2021 22:53:41 +0100 -Subject: [PATCH] Fix bug #81026 (PHP-FPM oob R/W in root process leading to - priv escalation) +Subject: [PATCH 1/2] Fix bug #81026 (PHP-FPM oob R/W in root process leading + to priv escalation) The main change is to store scoreboard procs directly to the variable sized array rather than indirectly through the pointer. @@ -398,3 +398,32 @@ index 90e155975e..96b7ca50fc 100644 -- 2.31.1 +From b84a7a8c2db91714bfb2894894e61758189983df Mon Sep 17 00:00:00 2001 +From: Remi Collet +Date: Wed, 20 Oct 2021 14:06:59 +0200 +Subject: [PATCH 2/2] NEWS + +--- + NEWS | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/NEWS b/NEWS +index 1e8a7c7903..b8b1849134 100644 +--- a/NEWS ++++ b/NEWS +@@ -1,6 +1,12 @@ + PHP NEWS + ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| + ++Backported from 7.4.25 ++ ++- FPM: ++ . Fixed bug #81026 (PHP-FPM oob R/W in root process leading to privilege ++ escalation) (CVE-2021-21703). (Jakub Zelenka) ++ + Backported from 7.3.30 + + - Phar: +-- +2.31.1 + -- cgit