From 91bcadd85e20e50d3f8c2e9721327681640e6f16 Mon Sep 17 00:00:00 2001
From: Remi Collet <remi@php.net>
Date: Fri, 6 Jun 2014 14:16:04 +0200
Subject: [PATCH 1/2] Fix bug #67390 insecure temporary file use in the
 configure script

---
 acinclude.m4 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acinclude.m4 b/acinclude.m4
index 448659f9201..25f3655112c 100644
--- a/acinclude.m4
+++ b/acinclude.m4
@@ -1711,7 +1711,7 @@ int main(int argc, char *argv[])
 {
   FILE *fp;
   long position;
-  char *filename = "/tmp/phpglibccheck";
+  char *filename = tmpnam(NULL);
   
   fp = fopen(filename, "w");
   if (fp == NULL) {

From 811f35d0ed6c843be7cd895640592588be354254 Mon Sep 17 00:00:00 2001
From: Remi Collet <remi@php.net>
Date: Fri, 6 Jun 2014 14:17:54 +0200
Subject: [PATCH 2/2] NEWS

---
 NEWS | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/NEWS b/NEWS
index 66cb748d2ae..bb2cb1fd02d 100644
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,8 @@ PHP                                                                        NEWS
 
 - Core:
   . Fixed BC break introduced by patch for bug #67072. (Anatol)
+  . Fixed bug #67390 (insecure temporary file use in the configure script).
+    (Remi) (CVE-2014-3981)
 
 - Date:
   . Fixed bug #67308 (Serialize of DateTime truncates fractions of second).