4 ms·

Looks like his definition of "has a security vulnuerability" is "is not the latest release". Does every release fix security vulnuerabilities?

by xyby 12y ago

Rygu 12y ago
PHP minor releases are bug and security fixes. But as long as the latest minor release fixed a vulnerability, in 99% of the cases, you can assume that all previous versions contain that vulnerability. (I know, I know, regressions do happen)
- xyby 12y ago
  Yes. But does every minor release fix bugs AND security holes? If some only fix bugs, the equation "not newest = insecure" is wrong.
  - ircmaxell 12y ago
    I counted any point release since the latest security release as secure. So for PHP's 5.6 line, only 5.6.4 is secure, since 5.6.4 is a security release. I'm currently crunching numbers for other platforms. For example, Nginx's last security release (for 1.7) was 1.7.5, so 1.7.5 -> 1.7.9 are all considered security.
  - lstamour 12y ago
    You can see a list of vulnerable PHP versions here: http://www.cvedetails.com/version-list/74/128/1/PHP-PHP.html http://www.cvedetails.com/version-list/74/128/1/PHP-PHP.html Note that this list refers to those versions as released, not as OS vendors may have patched them.
  - TylerE 12y ago
    It's PHP. Fingers in the dike. But don't take my word for it... http://php.net/ChangeLog-5.php http://php.net/ChangeLog-5.php At least 90% of releases have a bugfix with an associated CVE vulnerability.
smsm42 12y ago
For 5.4, recently, yes, since 5.4 is "security only" mode since 3 month ago. For others, not necessarily, since there are a lot of fixes and improvements. Look at CVEs in the changelogs[1], while understanding that CVEs sometimes are assigned for issues like "if you could run arbitrary PHP code, then you could run any code" which IMO is always the case since PHP is not a security sandbox. But if you do not have enough in-depth knowledge to assess CVEs, just CVE presence should be a good upper bound. Note also some security issues are in the modules that may not be even used by the particular server (fileinfo and EXIF modules provided a bunch of CVEs recently but not everybody uses them) or may not be used in a way that is exploitable (so, unserialize() CVEs are only an issue if you unserialize user-controlled data, which is not a best practice). This is not to say those are not security issue, but running PHP version with a CVE would not always make your server exploitable. That said, you should upgrade anyway. [1] http://php.net/ChangeLog-5.php http://php.net/ChangeLog-5.php

Looks like his definition of "has a security vulnuerability" is "is not the latest release". Does every release fix security vulnuerabilities?

by xyby 12y ago

Looks like his definition of "has a security vulnuerability" is "is not the latest release". Does every release fix security vulnuerabilities?

Rygu 12y ago

PHP minor releases are bug and security fixes. But as long as the latest minor release fixed a vulnerability, in 99% of the cases, you can assume that all previous versions contain that vulnerability. (I know, I know, regressions do happen)

xyby 12y ago
Yes. But does every minor release fix bugs AND security holes? If some only fix bugs, the equation "not newest = insecure" is wrong.
- ircmaxell 12y ago
  I counted any point release since the latest security release as secure. So for PHP's 5.6 line, only 5.6.4 is secure, since 5.6.4 is a security release. I'm currently crunching numbers for other platforms. For example, Nginx's last security release (for 1.7) was 1.7.5, so 1.7.5 -> 1.7.9 are all considered security.
- lstamour 12y ago
  You can see a list of vulnerable PHP versions here: http://www.cvedetails.com/version-list/74/128/1/PHP-PHP.html http://www.cvedetails.com/version-list/74/128/1/PHP-PHP.html Note that this list refers to those versions as released, not as OS vendors may have patched them.
- TylerE 12y ago
  It's PHP. Fingers in the dike. But don't take my word for it... http://php.net/ChangeLog-5.php http://php.net/ChangeLog-5.php At least 90% of releases have a bugfix with an associated CVE vulnerability.

smsm42 12y ago

For 5.4, recently, yes, since 5.4 is "security only" mode since 3 month ago. For others, not necessarily, since there are a lot of fixes and improvements. Look at CVEs in the changelogs[1], while understanding that CVEs sometimes are assigned for issues like "if you could run arbitrary PHP code, then you could run any code" which IMO is always the case since PHP is not a security sandbox. But if you do not have enough in-depth knowledge to assess CVEs, just CVE presence should be a good upper bound. Note also some security issues are in the modules that may not be even used by the particular server (fileinfo and EXIF modules provided a bunch of CVEs recently but not everybody uses them) or may not be used in a way that is exploitable (so, unserialize() CVEs are only an issue if you unserialize user-controlled data, which is not a best practice). This is not to say those are not security issue, but running PHP version with a CVE would not always make your server exploitable. That said, you should upgrade anyway. [1] http://php.net/ChangeLog-5.php http://php.net/ChangeLog-5.php