huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2012-0207: kernel: igmp: Avoid zero delay when receiving odd mixture of IGMP queries
Component: kernel
Severity: Moderate
Public date: 2012-01-10T00:00:00+00:00

The igmp_heard_query function in net/ipv4/igmp.c in the Linux kernel before 3.2.1 allows remote attackers to cause a denial of service (divide-by-zero error and panic) via IGMP packets.

Statement: This issue did not affect the Linux kernel as shipped with Red Hat Enterprise Linux 4 as it did not backport the upstream commit 5b7c8406.

Affected upstream versions: n/a
Fixed upstream versions: v3.3
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 25c413ad0029ea86008234be28aee33456e53e5b
CVE-2012-0698: trousers: DoS vulnerability in tcsd
Component: trousers
Severity: Low
Public date: 2012-01-13T00:00:00+00:00

A flaw was found in the way tcsd, the daemon that manages Trusted Computing resources, processed incoming TCP packets. A remote attacker could send a specially crafted TCP packet that, when processed by tcsd, could cause the daemon to crash. Note that by default tcsd accepts requests on localhost only.

Statement: The Red Hat Security Response Team has rated this issue as having low security impact. Trousers is only useful on systems with TPM hardware, additionally local access is required to exploit of this issue. Exploitation of this issue only results in a crash of the tcsd daemon which can be restarted. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Affected upstream versions: n/a
Upstream repository: https://trousers.git.sourceforge.net/git/trousers/trousers
Upstream fix commit: 50dd06a6f639b76b3bb629606ef71b2dc5407601
CVE-2012-0786: augeas: susceptible to symlink attack
Component: augeas
Severity: Low
Public date: 2012-08-11T00:00:00+00:00

The transform_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augnew file.


Affected upstream versions: n/a
Fixed upstream versions: release-1.0.0
Upstream repository: https://github.com/hercules-team/augeas
Upstream fix commit: 16387744
CVE-2012-0787: augeas: susceptible to mountpoint attack
Component: augeas
Severity: Low
Public date: 2012-07-19T00:00:00+00:00

The clone_file function in transfer.c in Augeas before 1.0.0, when copy_if_rename_fails is set and EXDEV or EBUSY is returned by the rename function, allows local users to overwrite arbitrary files and obtain sensitive information via a bind mount on the (1) .augsave or (2) destination file when using the backup save option, or (3) .augnew file when using the newfile save option.


Affected upstream versions: n/a
Fixed upstream versions: release-1.0.0
Upstream repository: https://github.com/hercules-team/augeas
Upstream fix commit: b8de6a8c
CVE-2012-0810: kernel-rt: stack corruption when task gets scheduled out using the debug stack
Component: kernel-rt
Severity: Moderate
Public date: 2012-02-23T00:00:00+00:00

The int3 handler in the Linux kernel before 3.3 relies on a per-CPU debug stack, which allows local users to cause a denial of service (stack corruption and panic) via a crafted application that triggers certain lock contention.

Statement: This issue did not affect the Linux kernel as shipped with Red Hat Enterprise Linux 4, 5, and 6. This has been addressed in Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2012-0333.html.

Affected upstream versions: before 3.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/rt/linux-stable-rt.git
Upstream fix commit: e5d4e1c3ccee18c68f23d62ba77bda26e893d4f0
CVE-2012-0815: rpm: incorrect handling of negated offsets in headerVerifyInfo()
Component: rpm
Severity: Important
CWE: CWE-839 (Numeric Range Comparison Without Minimum Check)
Public date: 2012-04-03T00:00:00+00:00

The headerVerifyInfo function in lib/header.c in RPM before 4.9.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative value in a region offset of a package header, which is not properly handled in a numeric range comparison.


Affected upstream versions: n/a
Upstream repository: https://rpm.org/rpm.git
Upstream fix commit: 472e569562d4c90d7a298080e0052856aa7fa86b
CVE-2012-0841: libxml2: hash table collisions CPU usage DoS
Component: libxml2
Severity: Moderate
CWE: CWE-407 (Inefficient Algorithmic Complexity)
Public date: 2012-02-21T00:00:00+00:00

libxml2 before 2.8.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data.


Affected upstream versions: n/a
Fixed upstream versions: v2.8.0
Upstream repository: https://git.gnome.org/browse/libxml2
Upstream fix commit: 8973d58b7498fa5100a876815476b81fd1a2412a
CVE-2012-0864: glibc: FORTIFY_SOURCE format string protection bypass via "nargs" integer overflow
Component: glibc
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2010-11-17T00:00:00+00:00

Integer overflow in the vfprintf function in stdio-common/vfprintf.c in glibc 2.14 and other versions allows context-dependent attackers to bypass the FORTIFY_SOURCE protection mechanism, conduct format string attacks, and write to arbitrary memory via a large number of arguments.


Affected upstream versions: n/a
Fixed upstream versions: glibc-2.16
Upstream repository: https://sourceware.org/git/glibc.git
Upstream fix commit: 7c1f4834d398163d1ac8101e35e9c36fc3176e6e
CVE-2012-0875: systemtap: kernel panic when processing malformed DWARF unwind data
Component: systemtap
Severity: Moderate
Public date: 2012-02-20T00:00:00+00:00

SystemTap 1.7, 1.6.7, and probably other versions, when unprivileged mode is enabled, allows local users to obtain sensitive information from kernel memory or cause a denial of service (kernel panic and crash) via vectors related to crafted DWARF data, which triggers a read of an invalid pointer.


Affected upstream versions: n/a
Fixed upstream versions: release-1.8
Upstream repository: https://sourceware.org/git/systemtap.git
Upstream fix commit: 64b0cff3b
CVE-2012-0879: kernel: block: CLONE_IO io_context refcounting issues
Component: kernel
Severity: Moderate
Public date: 2009-12-04T00:00:00+00:00

The I/O implementation for block devices in the Linux kernel before 2.6.33 does not properly handle the CLONE_IO feature, which allows local users to cause a denial of service (I/O instability) by starting multiple processes that share an I/O context.

Statement: This issue affects the Linux kernel as shipped with Red Hat Enterprise Linux 6. This issue does not affect the Linux kernel as shipped with Red Hat Enterprise Linux 4 and 5 as they did not provide support for CLONE_IO. This issue does not affect the Linux kernel as shipped with Red Hat Enterprise MRG as they already contain the fix. This has been addressed in Red Hat Enterprise Linux 6 via https://rhn.redhat.com/errata/RHSA-2012-0481.html.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.33
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 61cc74fbb87af6aa551a06a370590c9bc07e29d9
CVE-2012-0957: kernel: uts: stack memory leak in UNAME26
Component: kernel
Severity: Low
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
Public date: 2012-10-09T00:00:00+00:00

The override_release function in kernel/sys.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from kernel stack memory via a uname system call in conjunction with a UNAME26 personality.

Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 5.

This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 6.

This issue did affect the version of Linux kernel as shipped with Red Hat Enterprise MRG 2.

Affected upstream versions: n/a
Fixed upstream versions: v3.7
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 2702b1526c7278c4d65d78de209a465d4de2885e
CVE-2012-1013: krb5: kadmind denial of service
Component: krb5
Severity: Low
Public date: 2012-06-01T00:00:00+00:00

The check_1_6_dummy function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.8.x, 1.9.x, and 1.10.x before 1.10.2 allows remote authenticated administrators to cause a denial of service (NULL pointer dereference and daemon crash) via a KRB5_KDB_DISALLOW_ALL_TIX create request that lacks a password.

Statement: Not vulnerable. This issue did not affect the versions of krb5 as shipped with Red Hat Enterprise Linux 4 and 5.

Affected upstream versions: n/a
Fixed upstream versions: kfw-4.1-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: c5be6209311d4a8f10fda37d0d3f876c1b33b77b
CVE-2012-1016: krb5: PKINIT null pointer deref leads to DoS
Component: krb5
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
Public date: 2013-02-15T00:00:00+00:00

The pkinit_server_return_padata function in plugins/preauth/pkinit/pkinit_srv.c in the PKINIT implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.4 attempts to find an agility KDF identifier in inappropriate circumstances, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted Draft 9 request.

Statement: This issue did not affect the versions of krb5 as shipped with Red Hat Enterprise Linux 5 as they did not include support for PKINIT.

Affected upstream versions: n/a
Fixed upstream versions: krb5-1.10.4-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: db64ca25d661a47b996b4e2645998b5d7f0eb52c
CVE-2012-1090: kernel: cifs: dentry refcount leak when opening a FIFO on lookup leads to panic on unmount
Component: kernel
Severity: Moderate
Public date: 2012-02-23T00:00:00+00:00

The cifs_lookup function in fs/cifs/dir.c in the Linux kernel before 3.2.10 allows local users to cause a denial of service (OOPS) via attempted access to a special file, as demonstrated by a FIFO.

Statement: This issue did not affect the Linux kernel as shipped with Red Hat Enterprise
Linux 4 and 5 as they did not backport the commit 
a6ce4932fbdbcd8f8e8c6df76812014351c32892 that introduced this issue. This issue did not affect the Linux kernel as shipped with Red Hat Enterprise MRG 2. This has been addressed in Red Hat Enterprise Linux 6 via https://rhn.redhat.com/errata/RHSA-2012-0481.html.

Affected upstream versions: n/a
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 88d7d4e4a439f32acc56a6d860e415ee71d3df08
CVE-2012-1097: kernel: regset: Prevent null pointer reference on readonly regsets
Component: kernel
Severity: Moderate
Public date: 2012-03-03T00:00:00+00:00

The regset (aka register set) feature in the Linux kernel before 3.2.10 does not properly handle the absence of .get and .set methods, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a (1) PTRACE_GETREGSET or (2) PTRACE_SETREGSET ptrace call.

Statement: This issue did not affect the Linux kernel as shipped with Red Hat Enterprise Linux 5 as it did not backport upstream commits 4206d3aa and 5bde4d18.

Affected upstream versions: n/a
Fixed upstream versions: v3.3
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: c8e252586f8d5de906385d8cf6385fee289a825e
CVE-2012-1179: kernel: thp: __split_huge_page() mapcount != page_mapcount BUG_ON()
Component: kernel
Severity: Moderate
Public date: 2012-03-15T00:00:00+00:00

The Linux kernel before 3.3.1, when KVM is used, allows guest OS users to cause a denial of service (host OS crash) by leveraging administrative access to the guest OS, related to the pmd_none_or_clear_bad function and page faults for huge pages.


Affected upstream versions: n/a
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 4a1d704194a441bf83c636004a479e01360ec850
CVE-2012-1568: kernel: execshield: predictable ascii armour base address
Component: kernel
Severity: Low
Public date: 2012-03-17T00:00:00+00:00

The ExecShield feature in a certain Red Hat patch for the Linux kernel in Red Hat Enterprise Linux (RHEL) 5 and 6 and Fedora 15 and 16 does not properly handle use of many shared libraries by a 32-bit executable file, which makes it easier for context-dependent attackers to bypass the ASLR protection mechanism by leveraging a predictable base address for one of these libraries.


Affected upstream versions: n/a
Upstream repository: https://oss.oracle.com/git/redpatch.git
Upstream fix commit: 302a4fc15aebf202b6dffd6c804377c6058ee6e4
CVE-2012-1571: file: out of bounds read in CDF parser
Component: file
Severity: Low
CWE: CWE-122 (Heap-based Buffer Overflow)
Public date: 2012-02-16T00:00:00+00:00

A denial of service flaw was found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file.

Statement: This issue did not affect the versions of the php and file packages as shipped with Red Hat Enterprise Linux 5 and 7.

Affected upstream versions: n/a
Fixed upstream versions: FILE5_11
Upstream repository: https://github.com/glensc/file
Upstream fix commit: 1aec04dbf8a24b8a6ba64c4f74efa0628e36db0b
CVE-2012-1573: gnutls: TLS record handling issue (GNUTLS-SA-2012-2, MU-201202-01)
Component: gnutls
Severity: Important
Public date: 2012-03-21T00:00:00+00:00

gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/gitweb/gnutls.git
Upstream fix commit: b495740f2ff66550ca9395b3fda3ea32c3acb185
CVE-2012-1583: kernel: ipv6: panic using raw sockets
Component: kernel
Severity: Important
CWE: CWE-1341 (Multiple Releases of Same Resource or Handle)
Public date: 2012-04-17T00:00:00+00:00

Double free vulnerability in the xfrm6_tunnel_rcv function in net/ipv6/xfrm6_tunnel.c in the Linux kernel before 2.6.22, when the xfrm6_tunnel module is enabled, allows remote attackers to cause a denial of service (panic) via crafted IPv6 packets.

Statement: This issue did not affect the Linux kernel as shipped with Red Hat Enterprise Linux 6, and Red Hat Enterprise MRG. This has been addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2012-0480.html. A future kernel update for Red Hat Enterprise Linux 4 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v2.6.22
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: d0772b70faaf8e9f2013b6c4273d94d5eac8047a
CVE-2012-1601: kernel: kvm: irqchip_in_kernel() and vcpu->arch.apic inconsistency
Component: kernel
Severity: Moderate
Public date: 2012-02-07T00:00:00+00:00

The KVM implementation in the Linux kernel before 3.3.6 allows host OS users to cause a denial of service (NULL pointer dereference and host OS crash) by making a KVM_CREATE_IRQCHIP ioctl call after a virtual CPU already exists.

Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise MRG as they did not provide support for the KVM subsystem. This has been addressed in Red Hat Enterprise Linux 6 via https://rhn.redhat.com/errata/RHSA-2012-0571.html. This has been addressed in Red Hat Enterprise Linux 5 via RHSA-2012:0676 https://rhn.redhat.com/errata/RHSA-2012-0676.html.

Affected upstream versions: n/a
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 9c895160d25a76c21b65bad141b08e8d4f99afef
CVE-2012-2100: kernel: ext4: fix inconsistency in ext4_fill_flex_info()
Component: kernel
Severity: Low
Public date: 2012-01-10T00:00:00+00:00

The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 3.2.2, on the x86 platform and unspecified other platforms, allows user-assisted remote attackers to trigger inconsistent filesystem-groups data and possibly cause a denial of service via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value).  NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-4307.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise MRG 2.

Affected upstream versions: n/a
Fixed upstream versions: v3.3
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: d50f2ab6f050311dbf7b8f5501b25f0bf64a439b
CVE-2012-2119: kernel: macvtap: zerocopy: vector length is not validated before pinning user pages
Component: kernel
Severity: Important
Public date: 2012-04-16T00:00:00+00:00

Buffer overflow in the macvtap device driver in the Linux kernel before 3.4.5, when running in certain configurations, allows privileged KVM guest users to cause a denial of service (crash) via a long descriptor with a long vector length.


Affected upstream versions: n/a
Fixed upstream versions: v3.5
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: b92946e2919134ebe2a4083e4302236295ea2a73
CVE-2012-2121: kvm: device assignment page leak
Component: kvm
Severity: Moderate
Public date: 2012-03-29T00:00:00+00:00

The KVM implementation in the Linux kernel before 3.3.4 does not properly manage the relationships between memory slots and the iommu, which allows guest OS users to cause a denial of service (memory leak and host OS crash) by leveraging administrative access to the guest OS to conduct hotunplug and hotplug operations on devices.


Affected upstream versions: n/a
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 09ca8e1173bcb12e2a449698c9ae3b86a8a10195
CVE-2012-2123: kernel: fcaps: clear the same personality flags as suid when fcaps are used
Component: kernel
Severity: Important
Public date: 2012-04-17T00:00:00+00:00

The cap_bprm_set_creds function in security/commoncap.c in the Linux kernel before 3.3.3 does not properly handle the use of file system capabilities (aka fcaps) for implementing a privileged executable file, which allows local users to bypass intended personality restrictions via a crafted application, as demonstrated by an attack that uses a parent process to disable ASLR.

Statement: This issue did not affect the Linux kernel as shipped with Red Hat Enterprise Linux 4, and 5. This has been addressed in Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2012-0670.html. This has been addressed in Red Hat Enterprise Linux 6 via https://rhn.redhat.com/errata/RHSA-2012-0743.html.

Affected upstream versions: n/a
Fixed upstream versions: v3.4
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: d52fc5dde171f030170a6cb78034d166b13c9445
CVE-2012-2133: kernel: use after free bug in "quota" handling
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
Public date: 2012-03-22T00:00:00+00:00

Use-after-free vulnerability in the Linux kernel before 3.3.6, when huge pages are enabled, allows local users to cause a denial of service (system crash) or possibly gain privileges by interacting with a hugetlbfs filesystem, as demonstrated by a umount operation that triggers improper handling of quota data.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5. Future kernel updates for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux MRG 2 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v3.4
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: 90481622d75715bfcb68501280a917dbfe516029
CVE-2012-2136: kernel: net: insufficient data_len validation in sock_alloc_send_pskb()
Component: kernel
Severity: Important
CWE: CWE-1284 (Improper Validation of Specified Quantity in Input)
Public date: 2012-05-29T00:00:00+00:00

The sock_alloc_send_pskb function in net/core/sock.c in the Linux kernel before 3.4.5 does not properly validate a certain length value, which allows local users to cause a denial of service (heap-based buffer overflow and system crash) or possibly gain privileges by leveraging access to a TUN/TAP device.


Affected upstream versions: n/a
Fixed upstream versions: v3.5
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: cc9b17ad29ecaa20bfe426a8d4dbfb94b13ff1cc
CVE-2012-2137: kernel: kvm: buffer overflow in kvm_set_irq()
Component: kernel
Severity: Important
Public date: 2012-06-05T00:00:00+00:00

Buffer overflow in virt/kvm/irq_comm.c in the KVM subsystem in the Linux kernel before 3.2.24 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to Message Signaled Interrupts (MSI), irq routing entries, and an incorrect check by the setup_routing_entry function before invoking the kvm_set_irq function.

Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG. This issue was addressed in Red Hat Enterprise Linux 6 via RHSA-2012:0743 https://rhn.redhat.com/errata/RHSA-2012-0743.html

Affected upstream versions: n/a
Fixed upstream versions: v3.5
Upstream repository: https://git.kernel.org/linux/kernel/git/torvalds/linux-2.6.git
Upstream fix commit: f2ebd422f71cda9c791f76f85d2ca102ae34a1ed
CVE-2012-2139: rubygem-mail: directory traversal
Component: rubygem-mail
Severity: Low
Public date: 2012-03-14T00:00:00+00:00

Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. (dot dot) in the to parameter.


Affected upstream versions: n/a
Fixed upstream versions: 2.4.4
Upstream repository: https://github.com/mikel/mail
Upstream fix commit: 29aca25218e4c82991400eb9b0c933626aefc98f
CVE-2012-2140: rubygem-mail: arbitrary command execution when using exim or sendmail from commandline
Component: rubygem-mail
Severity: Important
CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
Public date: 2012-03-14T00:00:00+00:00

The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.


Affected upstream versions: n/a
Fixed upstream versions: 2.4.2
Upstream repository: https://github.com/mikel/mail
Upstream fix commit: ac56f03bdfc30b379aeecd4ff317d08fdaa328c2
CVE-2012-2143: crypt(): DES encrypted password weakness
Component: crypt()
Severity: Moderate
Public date: 2012-05-30T00:00:00+00:00

The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.

Statement: This issue did not affect the version of php as shipped with Red Hat Enterprise Linux 5 as it did not include FreeSec's libcrypt cryptographic algorithms implementation yet. This issue was addressed in php53 package for Red Hat Enterprise Linux 5 via RHSA-2012:1047 and in php package for Red Hat Enterprise Linux 6 via RHSA-2012:1046.

Affected upstream versions: n/a
Fixed upstream versions: php-5.3.15
Upstream repository: https://git.php.net/php-src.git
Upstream fix commit: aab49e934de1fff046e659cbec46e3d053b41c34