Skip to content
OpenAdvisories
Medium USN-3566-2 5 CVEs

php5 vulnerabilities

Published May 22, 2019 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

USN-3566-1 fixed several vulnerabilities in PHP. This update provides
the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

It was discovered that PHP incorrectly handled certain files. An attacker
could possibly use this issue to access sensitive information.
(CVE-2018-20783)

It was discovered that PHP incorrectly handled certain files. An attacker
could possibly use this issue to access sensitive information or possibly
cause a crash, resulting in a denial of service. (CVE-2019-11036)

Original advisory details:

It was discovered that PHP incorrectly handled memory when unserializing
certain data. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly execute arbitrary code. This
issue only affected Ubuntu 12.04 ESM. (CVE-2017-12933)

It was discovered that PHP incorrectly handled locale length. A remote attacker
could possibly use this issue to cause PHP to crash, resulting in a denial of service.
This issue only affected Ubuntu 12.04 ESM. (CVE-2017-11362)

It was discovered that PHP incorrectly handled certain stream metadata. A remote
attacker could possibly use this issue to set arbitrary metadata. This issue only
affected Ubuntu 12.04 ESM. (CVE-2016-10712)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS php5 5.5.9+dfsg-1ubuntu4.29+esm2

Vulnerabilities 5

  • Medium 4.8
    CVE-2019-11036

    Heap over-read in PHP EXIF extension

    When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.

    PHP Group PHP php5 php7.0 Ubuntu Alpine
  • Unscored —
    CVE-2016-10712

    In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, all of the return values of stream_get_meta_data can b…

    php5 Ubuntu
  • Unscored —
    CVE-2017-11362

    In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7, ext/intl/msgformat/msgformat_parse.c does not restrict the locale leng…

    php5 php7.0 Ubuntu
  • Unscored —
    CVE-2017-12933

    The finish_nested_data function in ext/standard/var_unserializer.re in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.…

    php5 Ubuntu
  • Unscored —
    CVE-2018-20783

    In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR readi…

    php5 php7.0 php7.2 php7 Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2016-10712
  • report
    https://ubuntu.com/security/CVE-2017-11362
  • report
    https://ubuntu.com/security/CVE-2017-12933
  • report
    https://ubuntu.com/security/CVE-2018-20783
  • report
    https://ubuntu.com/security/CVE-2019-11036