1

"CVE-2018-5712" appears many times in PHP changelogs, which makes me confused. Could someone explain this phenomenon? Thanks.

7.2.5
7.2.1
7.1.17
7.1.13
7.0.30
7.0.27
5.6.36
5.6.33

https://www.php.net/ChangeLog-7.php

https://www.php.net/ChangeLog-5.php

Another question of mine has been closed by someone. So I have to modify this question to add that one below.

I can't find "CVE-2015-4603" on the PHP changelogs.

According to https://www.cvedetails.com/cve/CVE-2015-4603/, I guess it has been fixed in PHP 5.6.8. Am I right? Why doesn't the string "CVE-2015-4603" appear on the PHP changelog? How about PHP 7.0, 7.1, 7.2, 7.3, 7.4? Do they have this issue? Thanks in advance.

Box
  • 2,432
  • 1
  • 18
  • 20
  • 2
    Well it's a security fix, and all versions before the mentioned versions were affected, and had to be fixed. What exactly is unclear? Why they didn't only fix the latest version and told everybody to just upgrade? – CodeCaster Dec 02 '19 at 08:05
  • @CodeCaster Thanks for your comment. Why don't other security fixes appear so many times in PHP changelogs? – Box Dec 02 '19 at 08:12

1 Answers1

3

It means that the first attempt to fix the bug (CVE-2018-5712) failed, after the first fix the security vulnerability still exists and the PHP team has to fix it again.

For example:

PHP 7.2.5

Phar:
    Fixed bug #76129 (fix for CVE-2018-5712 may not be complete). (CVE-2018-10547)

PHP 7.2.1

Phar:
    Fixed bug #74782 (Reflected XSS in .phar 404 page). (CVE-2018-5712)

Fixed bugs doesn't affect newer releases. PHP 7.4 is very new so it isn't affected by CVE-2018-xxx or CVE-2015-xxx. Generally speaking, if a version is not mentioned by CVE, then it is not affected by the CVE.

Once a bug was fixed, it wouldn't affect newer versions. There are unit tests to ensure that the new versions can avoid the fixed bugs as much as possible. If there was a mistake during development and a fixed bug appeared in newer versions, it's called a "regression bug" and must be fixed again and logged into release notes.

shawn
  • 4,305
  • 1
  • 17
  • 25
  • Thanks for your reply. If my understanding is right, the issue "CVE-2018-5712" first appeared in PHP 5.6 and it had been fixed for two times. This happened to PHP 7.0, PHP 7.1, and PHP 7.2 as well. Fortunately, it hasn't affect PHP 7.3 and 7.4. Am I right? – Box Dec 02 '19 at 08:25
  • 1
    Yes. The first PHP7.3 was released on 06 Dec 2018, this bug was fixed at 26 Apr 2018 (as PHP 7.2.5). So as a professional team, PHP developers ensure that new PHP releases aren't affected by this bug. – shawn Dec 02 '19 at 08:33