Arseniy Reutov

**Name of the Vulnerable Software and Affected Versions** PHP versions prior to 5.3.22 PHP versions 5.4.x prior to 5.4.13 **Description** The issue is related to errors in privilege management in the ext/soap/soap.c component of the PHP interpreter. It allows a remote attacker to elevate their privileges. The problem arises from the lack of validation between the soap.wsdl cache dir directive and the open basedir directive, enabling remote attackers to bypass access restrictions by creating cached SOAP WSDL files in any directory. **Recommendations** For PHP versions prior to 5.3.22, update to version 5.3.22 or later. For PHP versions 5.4.x prior to 5.4.13, update to version 5.4.13 or later.

**Name of the Vulnerable Software and Affected Versions** PHP versions prior to 5.3.23 PHP versions 5.4.x prior to 5.4.13 **Description** The issue is related to an XML External Entity (XXE) problem in the soap xmlParseFile and soap xmlParseMemory functions, allowing remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference. This can lead to the disclosure of protected information. **Recommendations** For PHP versions prior to 5.3.23, update to version 5.3.23 or later. For PHP versions 5.4.x prior to 5.4.13, update to version 5.4.13 or later. As a temporary workaround, consider disabling the soap xmlParseFile and soap xmlParseMemory functions until a patch is available.