Skip to content
OpenAdvisories
High ELSA-2014-1767 4 CVEs

Important: php security update (Oracle Linux 7)

Published Oct 30, 2014 · Updated Oct 30, 2014

Ecosystem: Oracle Linux

Summary

[5.4.16-23.3]
- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710

[5.4.16-23.2]
- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670

Fixed packages 28

ReleasePackageFixed in
Oracle Linux · 7 php 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-bcmath 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-cli 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-common 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-dba 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-devel 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-embedded 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-enchant 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-fpm 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-gd 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-imap 0:5.3.3-40.el6_6
Oracle Linux · 7 php-intl 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-ldap 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-mbstring 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-mysql 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-mysqlnd 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-odbc 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-pdo 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-pgsql 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-process 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-pspell 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-recode 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-snmp 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-soap 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-tidy 0:5.3.3-40.el6_6
Oracle Linux · 7 php-xml 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-xmlrpc 0:5.4.16-23.el7_0.3
Oracle Linux · 7 php-zts 0:5.3.3-40.el6_6

Vulnerabilities 4

  • Unscored —
    CVE-2014-3668 EPSS 27%

    Buffer overflow in the date_from_ISO8601 function in the mkgmtime implementation in libxmlrpc/xmlrpc.c in the XMLRPC ex…

    php5 Ubuntu
  • Unscored —
    CVE-2014-3669 EPSS 29%

    Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.…

    php5 Ubuntu
  • Unscored —
    CVE-2014-3670 EPSS 23%

    The exif_ifd_make_value function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x b…

    php5 Ubuntu
  • Unscored —
    CVE-2014-3710 EPSS 14%

    The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure…

    php5 file file Debian Ubuntu