CVE:CVE-2015-5723
CNNVD:CNNVD-201510-621
多款Doctrine产品中存在安全漏洞，该漏洞源于程序为缓存目录分配全局可写权限。本地攻击者可借助特制的应用程序（umask设为0并将缓存条目以代码形式执行）利用该漏洞以附加权限执行任意PHP代码。以下产品及版本受到影响：Doctrine Annotations 1.2.7之前版本，Cache 1.3.2之前版本和1.4.2之前1.4.x版本，Common 2.4.3之前版本和2.5.1之前2.5.x版本，ORM 2.4.8之前版本和2.5.1之前2.5.x版本，MongoDB ODM 1.0.2之前版本，MongoDB ODM Bundle 3.0.1之前版本。
solution:Upgrade zend zend-cache to a higher version than 2.4.7,2.5.0,2.5.1,2.5.2,and avoid the version (,2.4.7],2.5.0,2.5.1,2.5.2; Upgrade debian debian_linux to a higher version than 7.0,8.0,and avoid the version 7.0,8.0; Upgrade doctrine-project object_relational_mapper to a higher version than 2.4.7,2.5.0,2.5.0:alpha1,2.5.0:alpha2,2.5.0:beta1,2.5.0:rc1,2.5.0:rc2,and avoid the version (,2.4.7],2.5.0,2.5.0:alpha1,2.5.0:alpha2,2.5.0:beta1,2.5.0:rc1,2.5.0:rc2; Upgrade doctrine-project doctrinemongodbbundle to a higher version than 3.0.0,and avoid the version 3.0.0; Upgrade zend zend_framework to a higher version than 2.4.7,1.12.15,and avoid the version (,2.4.7],(,1.12.15]; Upgrade doctrine-project common to a higher version than 2.4.2,2.5.0,2.5.0:beta1,and avoid the version (,2.4.2],2.5.0,2.5.0:beta1; Upgrade doctrine-project annotations to a higher version than 1.2.6,and avoid the version (,1.2.6]; Upgrade doctrine-project mongodb-odm to a higher version than 1.0.1,and avoid the version (,1.0.1]; Upgrade doctrine-project cache to a higher version than 1.3.1,1.4.0,1.4.1,and avoid the version (,1.3.1],1.4.0,1.4.1; Upgrade zend zf-apigility-doctrine to a higher version than 1.0.2,and avoid the version (,1.0.2]