CVE-2013-6501
Community has no fix.
This patch was developed internally.
Will be offered upstream.


--- php-5.3.29/ext/soap/php_sdl.c_orig	2015-07-06 14:07:57.231116620 -0700
+++ php-5.3.29/ext/soap/php_sdl.c	2015-07-06 14:10:38.341928952 -0700
@@ -1544,6 +1544,7 @@
 	int f;
 	struct stat st;
 	char *in, *buf;
+	uid_t euid;
 
 	f = open(fn, O_RDONLY|O_BINARY);
 	if (f < 0) {
@@ -1553,6 +1554,15 @@
 		close(f);
 		return NULL;
 	}
+	/*
+	 * If I'm not the owner of this file then someone might be
+	 * trying to spoof me.
+	 */
+	euid = geteuid();
+	if (st.st_uid != euid) {
+		close(f);
+		return NULL;
+	}
 	buf = in = emalloc(st.st_size);
 	if (read(f, in, st.st_size) != st.st_size) {
 		close(f);