Skip to content
OpenAdvisories
Medium ELSA-2014-1013 10 CVEs

Moderate: php security update (Oracle Linux 7)

Published Aug 6, 2014 · Updated Aug 6, 2014

Ecosystem: Oracle Linux

Summary

[5.4.16-23]
- fileinfo: cdf_unpack_summary_info() excessive looping
DoS. CVE-2014-0237
- fileinfo: CDF property info parsing nelements infinite
loop. CVE-2014-0238
- fileinfo: cdf_check_stream_offset insufficient boundary
check. CVE-2014-3479
- fileinfo: cdf_count_chain insufficient boundary check
CVE-2014-3480
- fileinfo: cdf_read_short_sector insufficient boundary
check. CVE-2014-0207
- fileinfo: cdf_read_property_info insufficient boundary
check. CVE-2014-3487
- fileinfo: fix extensive backtracking CVE-2013-7345
- core: type confusion issue in phpinfo(). CVE-2014-4721
- core: fix heap-based buffer overflow in DNS TXT record
parsing. CVE-2014-4049
- core: unserialize() SPL ArrayObject / SPLObjectStorage
type confusion flaw. CVE-2014-3515

Fixed packages 25

ReleasePackageFixed in
Oracle Linux · 7 php 0:5.4.16-23.el7_0
Oracle Linux · 7 php-bcmath 0:5.4.16-23.el7_0
Oracle Linux · 7 php-cli 0:5.4.16-23.el7_0
Oracle Linux · 7 php-common 0:5.4.16-23.el7_0
Oracle Linux · 7 php-dba 0:5.4.16-23.el7_0
Oracle Linux · 7 php-devel 0:5.4.16-23.el7_0
Oracle Linux · 7 php-embedded 0:5.4.16-23.el7_0
Oracle Linux · 7 php-enchant 0:5.4.16-23.el7_0
Oracle Linux · 7 php-fpm 0:5.4.16-23.el7_0
Oracle Linux · 7 php-gd 0:5.4.16-23.el7_0
Oracle Linux · 7 php-intl 0:5.4.16-23.el7_0
Oracle Linux · 7 php-ldap 0:5.4.16-23.el7_0
Oracle Linux · 7 php-mbstring 0:5.4.16-23.el7_0
Oracle Linux · 7 php-mysql 0:5.4.16-23.el7_0
Oracle Linux · 7 php-mysqlnd 0:5.4.16-23.el7_0
Oracle Linux · 7 php-odbc 0:5.4.16-23.el7_0
Oracle Linux · 7 php-pdo 0:5.4.16-23.el7_0
Oracle Linux · 7 php-pgsql 0:5.4.16-23.el7_0
Oracle Linux · 7 php-process 0:5.4.16-23.el7_0
Oracle Linux · 7 php-pspell 0:5.4.16-23.el7_0
Oracle Linux · 7 php-recode 0:5.4.16-23.el7_0
Oracle Linux · 7 php-snmp 0:5.4.16-23.el7_0
Oracle Linux · 7 php-soap 0:5.4.16-23.el7_0
Oracle Linux · 7 php-xml 0:5.4.16-23.el7_0
Oracle Linux · 7 php-xmlrpc 0:5.4.16-23.el7_0

Vulnerabilities 10

  • Medium 6.5
    CVE-2014-0207 EPSS 17%

    The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30…

    php5 file file Debian Ubuntu
  • Medium 6.5
    CVE-2014-3480 EPSS 11%

    The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5…

    php5 file file Debian Ubuntu
  • Unscored —
    CVE-2013-7345

    The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wild…

    file file Debian Ubuntu
  • Unscored —
    CVE-2014-0237 EPSS 20%

    The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 al…

    php5 file Debian Ubuntu
  • Unscored —
    CVE-2014-0238 EPSS 21%

    The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 all…

    php5 file Debian Ubuntu
  • Unscored —
    CVE-2014-3479 EPSS 15%

    The cdf_check_stream_offset function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.…

    php5 file file Debian Ubuntu
  • Unscored —
    CVE-2014-3487 EPSS 15%

    The cdf_read_property_info function in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5…

    php5 file file Debian Ubuntu
  • Unscored —
    CVE-2014-3515 EPSS 30%

    The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures wil…

    php5 Ubuntu
  • Unscored —
    CVE-2014-4049 EPSS 11%

    Heap-based buffer overflow in the php_parserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remot…

    php5 Ubuntu
  • Unscored —
    CVE-2014-4721

    The phpinfo implementation in ext/standard/info.c in PHP before 5.4.30 and 5.5.x before 5.5.14 does not ensure use of t…

    php5 Ubuntu