Skip to content
OpenAdvisories
Unscored USN-3566-1 3 CVEs

php5 vulnerabilities

Published Feb 12, 2018 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that PHP incorrectly handled the PHAR 404 error page. A
remote attacker could possibly use this issue to conduct cross-site
scripting (XSS) attacks. (CVE-2018-5712)

It was discovered that PHP incorrectly handled memory when unserializing
certain data. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2017-12933)

It was discovered that PHP incorrectly handled 'front of' and 'back of'
date directives. A remote attacker could possibly use this issue to obtain
sensitive information. (CVE-2017-16642)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS php5 5.5.9+dfsg-1ubuntu4.23

Vulnerabilities 3

  • Unscored —
    CVE-2017-12933

    The finish_nested_data function in ext/standard/var_unserializer.re in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.…

    php5 Ubuntu
  • Unscored —
    CVE-2017-16642 Public exploit EPSS 26%

    In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib_meridian han…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2018-5712 EPSS 80%

    An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There i…

    php5 php7.0 php7 php5 Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2017-12933
  • report
    https://ubuntu.com/security/CVE-2017-16642
  • report
    https://ubuntu.com/security/CVE-2018-5712