php5 - security update

Fixed packages 1

Vulnerabilities 4

• Medium 4.8
  CVE-2019-11047

  Heap-buffer-overflow READ in exif

  When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer.…

  PHP Group PHP php5 php7.0 Ubuntu Alpine
  Dec 23, 2019
• Medium 4.8
  CVE-2019-11050

  Use-after-free in exif parsing under memory sanitizer

  When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer.…

  PHP Group PHP php5 php7.0 Ubuntu Alpine
  Dec 23, 2019
• Low 3.7
  CVE-2019-11045

  DirectoryIterator class silently truncates after a null byte

  In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths…

  PHP Group PHP php5 php7.0 Ubuntu Alpine
  Dec 23, 2019
• Low 3.7
  CVE-2019-11046

  Buffer underflow in bc_shift_addsub

  In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified a…

  PHP Group PHP php5 php7.0 Ubuntu
  Dec 23, 2019