FM / php8.1-common

/usr/share/doc/php8.1-common

Name	Size	Mode	Actions
changelog.Debian.gz	9739	0644	edit dl rm
changelog.gz	24181	0644	edit dl rm
copyright	33969	0644	edit dl rm
EXTENSIONS.gz	2950	0644	edit dl rm
README.Debian.gz	3165	0644	edit dl rm
README.Debian.security	1102	0644	edit dl rm
README.md.gz	2267	0644	edit dl rm
UPGRADING.gz	8756	0644	edit dl rm
UPGRADING.INTERNALS.gz	2834	0644	edit dl rm

Edit: /usr/share/doc/php8.1-common/README.Debian.security (1102B)

* Security issues which are caused by careless programming, such as:
   - extracting a tar file without first checking the contents;
   - using unserialize() on untrusted data;
   - relying on a specific value of short_open_tag.

* Vulnerabilities involving any kind of open_basedir violation, as
   this feature is not considered a security model either by us or by
   PHP upstream.

* Any "works as expected" vulnerabilities, such as "user can cause
   PHP to crash by writing a malicious PHP script", unless such
   vulnerabilities involve some kind of higher-level DoS or privilege
   escalation that would not otherwise be available.

PHP upstream has published a statement regarding their view on security
and the PHP interpreter:
http://www.php.net/security-note.php

The Debian stable security team does not provide security support for certain configurations known to be inherently insecure. This includes the interpreter itself, extensions, and user scripts written in the PHP language. Most specifically, but not exclusively, the security team will not provide support for the following. * Security issues which are caused by careless programming, such as: - extracting a tar file without first checking the contents; - using unserialize() on untrusted data; - relying on a specific value of short_open_tag. * Vulnerabilities involving any kind of open_basedir violation, as this feature is not considered a security model either by us or by PHP upstream. * Any "works as expected" vulnerabilities, such as "user can cause PHP to crash by writing a malicious PHP script", unless such vulnerabilities involve some kind of higher-level DoS or privilege escalation that would not otherwise be available. PHP upstream has published a statement regarding their view on security and the PHP interpreter: http://www.php.net/security-note.php