Skip to content
OpenAdvisories
Unscored USN-3382-1 13 CVEs

php5, php7.0 vulnerabilities

Published Aug 10, 2017 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that the PHP opcache created keys for files it cached
based on their filepath. A local attacker could possibly use this issue in
a shared hosting environment to obtain sensitive information. This issue
only affected Ubuntu 14.04 LTS. (CVE-2015-8994)

It was discovered that the PHP URL parser incorrectly handled certain URI
components. A remote attacker could possibly use this issue to bypass
hostname-specific URL checks. This issue only affected Ubuntu 14.04 LTS.
(CVE-2016-10397)

It was discovered that PHP incorrectly handled certain boolean parameters
when unserializing data. A remote attacker could possibly use this issue to
cause PHP to crash, resulting in a denial of service. This issue only
affected Ubuntu 14.04 LTS. (CVE-2017-11143)

Sebastian Li, Wei Lei, Xie Xiaofei, and Liu Yang discovered that PHP
incorrectly handled the OpenSSL sealing function. A remote attacker could
possibly use this issue to cause PHP to crash, resulting in a denial of
service. (CVE-2017-11144)

Wei Lei and Liu Yang discovered that the PHP date extension incorrectly
handled memory. A remote attacker could possibly use this issue to disclose
sensitive information from the server. (CVE-2017-11145)

It was discovered that PHP incorrectly handled certain PHAR archives. A
remote attacker could use this issue to cause PHP to crash or disclose
sensitive information. This issue only affected Ubuntu 14.04 LTS.
(CVE-2017-11147)

It was discovered that PHP incorrectly handled locale length. A remote
attacker could possibly use this issue to cause PHP to crash, resulting in
a denial of service. (CVE-2017-11362)

Wei Lei and Liu Yang discovered that PHP incorrectly handled parsing ini
files. An attacker could possibly use this issue to cause PHP to crash,
resulting in a denial of service. (CVE-2017-11628)

It was discovered that PHP mbstring incorrectly handled certain regular
expressions. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS php5 5.5.9+dfsg-1ubuntu4.22
Ubuntu · 16.04 LTS 16.04:LTS php7.0 7.0.22-0ubuntu0.16.04.1

Vulnerabilities 13

  • Unscored —
    CVE-2015-8994

    An issue was discovered in PHP 5.x and 7.x, when the configuration uses apache2handler/mod_php or php-fpm with OpCache …

    php5 Ubuntu
  • Unscored —
    CVE-2016-10397

    In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be use…

    php5 Ubuntu
  • Unscored —
    CVE-2017-11143

    In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able…

    php5 Ubuntu
  • Unscored —
    CVE-2017-11144

    In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check t…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2017-11145

    In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, an error in the date extension's timelib_meridian pars…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2017-11147

    In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious arc…

    php5 Ubuntu
  • Unscored —
    CVE-2017-11362

    In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7, ext/intl/msgformat/msgformat_parse.c does not restrict the locale leng…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2017-11628

    In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() …

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2017-9224

    An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through …

    php5 php7.0 php7 php5 Debian Ubuntu Alpine
  • Unscored —
    CVE-2017-9226

    An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through …

    php5 php7.0 php7 php5 Debian Ubuntu Alpine
  • Unscored —
    CVE-2017-9227

    An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through …

    php5 php7.0 php7 php5 Debian Ubuntu Alpine
  • Unscored —
    CVE-2017-9228

    An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through …

    php5 php7.0 php7 php5 Debian Ubuntu Alpine
  • Unscored —
    CVE-2017-9229

    An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through …

    php5 php7.0 php7 php5 Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2015-8994
  • report
    https://ubuntu.com/security/CVE-2016-10397
  • report
    https://ubuntu.com/security/CVE-2017-9224
  • report
    https://ubuntu.com/security/CVE-2017-9226
  • report
    https://ubuntu.com/security/CVE-2017-9227
  • report
    https://ubuntu.com/security/CVE-2017-9228
  • report
    https://ubuntu.com/security/CVE-2017-9229
  • report
    https://ubuntu.com/security/CVE-2017-11143
  • report
    https://ubuntu.com/security/CVE-2017-11144
  • report
    https://ubuntu.com/security/CVE-2017-11145
  • report
    https://ubuntu.com/security/CVE-2017-11147
  • report
    https://ubuntu.com/security/CVE-2017-11362
  • report
    https://ubuntu.com/security/CVE-2017-11628