git: 0e3c6e3e4496 - main - security/vuxml: Improve affected version ranges of composer vulnerability entry.
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Fri, 29 Sep 2023 23:27:10 UTC
The branch main has been updated by madpilot:
URL: https://cgit.FreeBSD.org/ports/commit/?id=0e3c6e3e4496986ed1fb6a9ca7a7bfe684ad747f
commit 0e3c6e3e4496986ed1fb6a9ca7a7bfe684ad747f
Author: Guido Falsi <madpilot@FreeBSD.org>
AuthorDate: 2023-09-29 23:26:14 +0000
Commit: Guido Falsi <madpilot@FreeBSD.org>
CommitDate: 2023-09-29 23:27:01 +0000
security/vuxml: Improve affected version ranges of composer vulnerability entry.
---
security/vuxml/vuln/2023.xml | 22 ++++++++++++++++++++--
1 file changed, 20 insertions(+), 2 deletions(-)
diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml
index fdcf2b9b620d..0e362a6e5146 100644
--- a/security/vuxml/vuln/2023.xml
+++ b/security/vuxml/vuln/2023.xml
@@ -4,14 +4,22 @@
<package>
<name>php80-composer</name>
<range><lt>1.10.27</lt></range>
+ <range><gt>2.0.0</gt><lt>2.6.4</lt></range>
</package>
<package>
<name>php81-composer</name>
<range><lt>1.10.27</lt></range>
+ <range><gt>2.0.0</gt><lt>2.6.4</lt></range>
</package>
<package>
<name>php82-composer</name>
<range><lt>1.10.27</lt></range>
+ <range><gt>2.0.0</gt><lt>2.6.4</lt></range>
+ </package>
+ <package>
+ <name>php83-composer</name>
+ <range><lt>1.10.27</lt></range>
+ <range><gt>2.0.0</gt><lt>2.6.4</lt></range>
</package>
<package>
<name>php80-composer2</name>
@@ -25,13 +33,22 @@
<name>php82-composer2</name>
<range><lt>2.6.4</lt></range>
</package>
+ <package>
+ <name>php83-composer2</name>
+ <range><lt>2.6.4</lt></range>
+ </package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Composer project reports:</p>
<blockquote cite="https://github.com/composer/composer/security/advisories/GHSA-jm6m-4632-36hf">
- <p>Description: Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be impacted if PHP also has register_argc_argv enabled in php.ini.</p>
- <p>Workaround: Make sure register_argc_argv is disabled in php.ini, and avoid publishing composer.phar to the web as this really should not happen.</p>
+ <p>Description: Users publishing a composer.phar to a
+ public web-accessible server where the composer.phar can
+ be executed as a php file may be impacted if PHP also has
+ register_argc_argv enabled in php.ini.</p>
+ <p>Workaround: Make sure register_argc_argv is disabled
+ in php.ini, and avoid publishing composer.phar to the web
+ as this really should not happen.</p>
</blockquote>
</body>
</description>
@@ -42,6 +59,7 @@
<dates>
<discovery>2023-09-29</discovery>
<entry>2023-09-29</entry>
+ <modified>2023-09-30</modified>
</dates>
</vuln>