Skip to content
OpenAdvisories
High ELSA-2015-1135 31 CVEs

Important: php security and bug fix update (Oracle Linux 7)

Published Jun 23, 2015 · Updated Jun 23, 2015

Ecosystem: Oracle Linux

Summary

[5.4.16-36]
- fix more functions accept paths with NUL character #1213407

[5.4.16-35]
- core: fix multipart/form-data request can use excessive
amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
file #1213442
- ftp: fix integer overflow leading to heap overflow when
reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
empty entry file name CVE-2015-4021
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
interpreter under httpd 2.4 CVE-2015-3330

[5.4.16-34]
- fix memory corruption in fileinfo module on big endian
machines #1082624
- fix segfault in pdo_odbc on x86_64 #1159892
- fix segfault in gmp allocator #1154760

[5.4.16-33]
- core: use after free vulnerability in unserialize()
CVE-2014-8142 and CVE-2015-0231
- core: fix use-after-free in unserialize CVE-2015-2787
- core: fix NUL byte injection in file name argument of
move_uploaded_file() CVE-2015-2348
- date: use after free vulnerability in unserialize CVE-2015-0273
- enchant: fix heap buffer overflow in enchant_broker_request_dict
CVE-2014-9705
- exif: free called on unitialized pointer CVE-2015-0232
- fileinfo: fix out of bounds read in mconvert CVE-2014-9652
- gd: fix buffer read overflow in gd_gif_in.c CVE-2014-9709
- phar: use after free in phar_object.c CVE-2015-2301
- soap: fix type confusion through unserialize

[5.4.16-31]
- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710

[5.4.16-29]
- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670

[5.4.16-27]
- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- fileinfo: fix extensive backtracking in regular expression
(incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: fix mconvert incorrect handling of truncated
pascal string size. CVE-2014-3478
- fileinfo: fix cdf_read_property_info
(incomplete fix for CVE-2012-1571). CVE-2014-3587
- spl: fix use-after-free in ArrayIterator due to object
change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- network: fix segfault in dns_get_record
(incomplete fix for CVE-2014-4049). CVE-2014-3597

[5.4.16-25]
- fix segfault after startup on aarch64 (#1107567)
- compile php with -O3 on ppc64le (#1123499)

Fixed packages 25

ReleasePackageFixed in
Oracle Linux · 7 php 0:5.4.16-36.el7_1
Oracle Linux · 7 php-bcmath 0:5.4.16-36.el7_1
Oracle Linux · 7 php-cli 0:5.4.16-36.el7_1
Oracle Linux · 7 php-common 0:5.4.16-36.el7_1
Oracle Linux · 7 php-dba 0:5.4.16-36.el7_1
Oracle Linux · 7 php-devel 0:5.4.16-36.el7_1
Oracle Linux · 7 php-embedded 0:5.4.16-36.el7_1
Oracle Linux · 7 php-enchant 0:5.4.16-36.el7_1
Oracle Linux · 7 php-fpm 0:5.4.16-36.el7_1
Oracle Linux · 7 php-gd 0:5.4.16-36.el7_1
Oracle Linux · 7 php-intl 0:5.4.16-36.el7_1
Oracle Linux · 7 php-ldap 0:5.4.16-36.el7_1
Oracle Linux · 7 php-mbstring 0:5.4.16-36.el7_1
Oracle Linux · 7 php-mysql 0:5.4.16-36.el7_1
Oracle Linux · 7 php-mysqlnd 0:5.4.16-36.el7_1
Oracle Linux · 7 php-odbc 0:5.4.16-36.el7_1
Oracle Linux · 7 php-pdo 0:5.4.16-36.el7_1
Oracle Linux · 7 php-pgsql 0:5.4.16-36.el7_1
Oracle Linux · 7 php-process 0:5.4.16-36.el7_1
Oracle Linux · 7 php-pspell 0:5.4.16-36.el7_1
Oracle Linux · 7 php-recode 0:5.4.16-36.el7_1
Oracle Linux · 7 php-snmp 0:5.4.16-36.el7_1
Oracle Linux · 7 php-soap 0:5.4.16-36.el7_1
Oracle Linux · 7 php-xml 0:5.4.16-36.el7_1
Oracle Linux · 7 php-xmlrpc 0:5.4.16-36.el7_1

Vulnerabilities 31

  • Unscored —
    CVE-2014-8142 Public exploit EPSS 55%

    Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.…

    php5 Ubuntu
  • Unscored —
    CVE-2014-9652

    The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x…

    php5 file file Debian Ubuntu
  • Unscored —
    CVE-2014-9705 EPSS 19%

    Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5…

    php5 Ubuntu
  • Unscored —
    CVE-2014-9709 EPSS 15%

    The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allo…

    libgd2 libgd2 Debian Ubuntu
  • Unscored —
    CVE-2015-0231 Public exploit EPSS 44%

    Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.…

    php5 Ubuntu
  • Unscored —
    CVE-2015-0232 EPSS 16%

    The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 …

    php5 Ubuntu
  • Unscored —
    CVE-2015-0273 Public exploit EPSS 43%

    Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x bef…

    php5 Ubuntu
  • Unscored —
    CVE-2015-2301 EPSS 15%

    Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before…

    php5 Ubuntu
  • Unscored —
    CVE-2015-2348

    The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and …

    php5 Ubuntu
  • Unscored —
    CVE-2015-2783

    ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sen…

    php5 Ubuntu
  • Unscored —
    CVE-2015-2787 EPSS 12%

    Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.…

    php5 Ubuntu
  • Unscored —
    CVE-2015-3307

    The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 a…

  • Unscored —
    CVE-2015-3329 EPSS 38%

    Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x bef…

    php5 Ubuntu
  • Unscored —
    CVE-2015-3330 EPSS 13%

    The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x bef…

    php5 Ubuntu
  • Unscored —
    CVE-2015-3411

    PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which…

    php5 Ubuntu
  • Unscored —
    CVE-2015-3412

    PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4021 EPSS 20%

    The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 doe…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4022 EPSS 20%

    Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x befo…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4024 EPSS 42%

    Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4025 EPSS 17%

    PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character …

    php5 Ubuntu
  • Unscored —
    CVE-2015-4026 EPSS 19%

    The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname up…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4147 EPSS 12%

    The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4148 Public exploit EPSS 20%

    The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4598

    PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequences, whic…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4599 EPSS 10%

    The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 a…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4600 EPSS 10%

    The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4601

    PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbi…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4602 EPSS 10%

    The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4603 EPSS 11%

    The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4604

    The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.…

  • Unscored —
    CVE-2015-4605

    The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5…