Skip to content
OpenAdvisories
High ELSA-2015-1066 28 CVEs

Important: php54 security and bug fix update (Oracle Linux 7)

Published Feb 4, 2016 · Updated Feb 4, 2016

Ecosystem: Oracle Linux

Summary

php54
[2.0-1]
- fix incorrect selinux contexts #1194332

php54-php
[5.4.40-1]
- rebase to PHP 5.4.40 for various security fix #1209887

[5.4.37-1]
- rebase to PHP 5.4.37

[5.4.36-1]
- rebase to PHP 5.4.36 #1168193
- fix package name in description
- php-fpm own session dir

php54-php-pecl-zendopcache
[7.0.4-3]
- fix use after free CVE-2015-1351

[7.0.4-2]
- add upstream patch for failed test

[7.0.4-1]
- Update to 7.0.4

[7.0.3-1]
- update to 7.0.3 #1055927

Fixed packages 29

ReleasePackageFixed in
Oracle Linux · 7 php54 0:2.0-1.el7
Oracle Linux · 7 php54-php 0:5.4.40-1.el7
Oracle Linux · 7 php54-php-bcmath 0:5.4.40-1.el7
Oracle Linux · 7 php54-php-cli 0:5.4.40-1.el7
Oracle Linux · 7 php54-php-common 0:5.4.40-1.el7
Oracle Linux · 7 php54-php-dba 0:5.4.40-1.el7
Oracle Linux · 7 php54-php-devel 0:5.4.40-1.el7
Oracle Linux · 7 php54-php-enchant 0:5.4.40-1.el7
Oracle Linux · 7 php54-php-fpm 0:5.4.40-1.el7
Oracle Linux · 7 php54-php-gd 0:5.4.40-1.el7
Oracle Linux · 7 php54-php-imap 0:5.4.40-1.el6
Oracle Linux · 7 php54-php-intl 0:5.4.40-1.el7
Oracle Linux · 7 php54-php-ldap 0:5.4.40-1.el7
Oracle Linux · 7 php54-php-mbstring 0:5.4.40-1.el7
Oracle Linux · 7 php54-php-mysqlnd 0:5.4.40-1.el7
Oracle Linux · 7 php54-php-odbc 0:5.4.40-1.el7
Oracle Linux · 7 php54-php-pdo 0:5.4.40-1.el7
Oracle Linux · 7 php54-php-pecl-zendopcache 0:7.0.4-3.el7
Oracle Linux · 7 php54-php-pgsql 0:5.4.40-1.el7
Oracle Linux · 7 php54-php-process 0:5.4.40-1.el7
Oracle Linux · 7 php54-php-pspell 0:5.4.40-1.el7
Oracle Linux · 7 php54-php-recode 0:5.4.40-1.el7
Oracle Linux · 7 php54-php-snmp 0:5.4.40-1.el7
Oracle Linux · 7 php54-php-soap 0:5.4.40-1.el7
Oracle Linux · 7 php54-php-tidy 0:5.4.40-1.el6
Oracle Linux · 7 php54-php-xml 0:5.4.40-1.el7
Oracle Linux · 7 php54-php-xmlrpc 0:5.4.40-1.el7
Oracle Linux · 7 php54-runtime 0:2.0-1.el7
Oracle Linux · 7 php54-scldevel 0:2.0-1.el7

Vulnerabilities 28

  • Unscored —
    CVE-2014-8142 Public exploit EPSS 55%

    Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.…

    php5 Ubuntu
  • Unscored —
    CVE-2014-9427 EPSS 18%

    sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mma…

    php5 Ubuntu
  • Unscored —
    CVE-2014-9652

    The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x…

    php5 file file Debian Ubuntu
  • Unscored —
    CVE-2014-9705 EPSS 19%

    Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5…

    php5 Ubuntu
  • Unscored —
    CVE-2014-9709 EPSS 15%

    The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allo…

    libgd2 libgd2 Debian Ubuntu
  • Unscored —
    CVE-2015-0231 Public exploit EPSS 44%

    Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.…

    php5 Ubuntu
  • Unscored —
    CVE-2015-0232 EPSS 16%

    The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 …

    php5 Ubuntu
  • Unscored —
    CVE-2015-0273 Public exploit EPSS 43%

    Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x bef…

    php5 Ubuntu
  • Unscored —
    CVE-2015-1351

    Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP…

    php5 Ubuntu
  • Unscored —
    CVE-2015-2301 EPSS 15%

    Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before…

    php5 Ubuntu
  • Unscored —
    CVE-2015-2305

    Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32…

    php5 radare2 clamav clamav Debian Ubuntu
  • Unscored —
    CVE-2015-2348

    The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and …

    php5 Ubuntu
  • Unscored —
    CVE-2015-2783

    ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sen…

    php5 Ubuntu
  • Unscored —
    CVE-2015-2787 EPSS 12%

    Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.…

    php5 Ubuntu
  • Unscored —
    CVE-2015-3307

    The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 a…

  • Unscored —
    CVE-2015-3329 EPSS 38%

    Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x bef…

    php5 Ubuntu
  • Unscored —
    CVE-2015-3330 EPSS 13%

    The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x bef…

    php5 Ubuntu
  • Unscored —
    CVE-2015-3411

    PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which…

    php5 Ubuntu
  • Unscored —
    CVE-2015-3412

    PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4147 EPSS 12%

    The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4148 Public exploit EPSS 20%

    The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4599 EPSS 10%

    The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 a…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4600 EPSS 10%

    The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4601

    PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbi…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4602 EPSS 10%

    The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4603 EPSS 11%

    The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4604

    The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.…

  • Unscored —
    CVE-2015-4605

    The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5…