Security - PHP RCEs reported

mtu said:
Indeed. The challenge wasn't fundamentally different for Debian, and they had packages in the repos within 1 hour.
Click to expand...

I think the FreeBSD ports commit was even earlier. But that's not packages. The way that dependencies work in pkg would have to be re-worked to reliably integrate updates single packages into the larger (previous) repository. That's my understanding.

Nontheless in this particular case I was indeed able to build php directly and it "fit". Maybe I should have made my packages available for other to just drop in from the commandline, but I don't have all releases.
 
i386 14 looks like it has .12 sooner than anything aarch64: https://www.freshports.org/lang/php85
mer said:
Heck even MS winds up hearing about problems and then taking a finite amount of time to fix them.
Click to expand...
If I was still using Windows on my server, I'd have solved this days ago by extracting php.net's zip :p
cracauer@ said:
Think of the poor ARM people and when they will get the update.
Click to expand...
covacat said:
arm64 does not have it in latest either. just build it yourself
Click to expand...
aarch64 seems second-class everywhere (no update 16.0-CURRENT, still .11 openSUSE TW)

I considered Windows ARM on Pi with x86 emu for nginx/PHP, and it almost happened except USB I/O is slow (something about rpiuxflt filter). OS hopping is more fun than building :p (learned a lot about u-boot and RPi firmware last few days, and discovered fake-hwclock to handle systemd timers without RTC)
 
> For me it seems to be random, which builds are started first and therefore finish first. Could anybody clarify?

Maybe, coming out of this event, the great developers of FreeBSD will issue some manner of dissertation about this and what was learned.
 
You must log in or register to reply here.
Back
Top