Skip to content
OpenAdvisories
High ELSA-2015-1186 18 CVEs

Important: php55-php security update (Oracle Linux 7)

Published Feb 4, 2016 · Updated Feb 4, 2016

Ecosystem: Oracle Linux

Summary

[5.5.21-4]
- fix more functions accept paths with NUL character #1213407

[5.5.21-3]
- core: fix multipart/form-data request can use excessive
amount of CPU usage CVE-2015-4024
- fix various functions accept paths with NUL character
CVE-2015-4025, CVE-2015-4026, #1213407
- fileinfo: fix denial of service when processing a crafted
file #1213442
- ftp: fix integer overflow leading to heap overflow when
reading FTP file listing CVE-2015-4022
- phar: fix buffer over-read in metadata parsing CVE-2015-2783
- phar: invalid pointer free() in phar_tar_process_metadata()
CVE-2015-3307
- phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
- phar: fix memory corruption in phar_parse_tarfile caused by
empty entry file name CVE-2015-4021
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1222538
- apache2handler: fix pipelined request executed in deinitialized
interpreter under httpd 2.4 CVE-2015-3330

Fixed packages 25

ReleasePackageFixed in
Oracle Linux · 7 php55-php 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-bcmath 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-cli 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-common 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-dba 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-devel 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-enchant 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-fpm 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-gd 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-gmp 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-intl 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-ldap 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-mbstring 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-mysqlnd 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-odbc 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-opcache 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-pdo 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-pgsql 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-process 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-pspell 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-recode 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-snmp 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-soap 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-xml 0:5.5.21-4.el7
Oracle Linux · 7 php55-php-xmlrpc 0:5.5.21-4.el7

Vulnerabilities 18

  • Unscored —
    CVE-2015-2783

    ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sen…

    php5 Ubuntu
  • Unscored —
    CVE-2015-3307

    The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 a…

  • Unscored —
    CVE-2015-3329 EPSS 38%

    Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x bef…

    php5 Ubuntu
  • Unscored —
    CVE-2015-3330 EPSS 13%

    The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x bef…

    php5 Ubuntu
  • Unscored —
    CVE-2015-3411

    PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which…

    php5 Ubuntu
  • Unscored —
    CVE-2015-3412

    PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4021 EPSS 20%

    The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 doe…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4022 EPSS 20%

    Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x befo…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4024 EPSS 42%

    Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4025 EPSS 17%

    PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character …

    php5 Ubuntu
  • Unscored —
    CVE-2015-4026 EPSS 19%

    The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname up…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4598

    PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequences, whic…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4602 EPSS 10%

    The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4603 EPSS 11%

    The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4604

    The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.…

  • Unscored —
    CVE-2015-4605

    The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5…

  • Unscored —
    CVE-2015-4643 EPSS 15%

    Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x befo…

    php5 Ubuntu
  • Unscored —
    CVE-2015-4644

    The php_pgsql_meta_data function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP before 5.4.42, 5.5.x before …

    php5 Ubuntu