Skip to content
OpenAdvisories
Unscored USN-3600-1 3 CVEs

php5, php7.0, php7.1 vulnerabilities

Published Mar 19, 2018 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that PHP incorrectly handled certain stream metadata. A
remote attacker could possibly use this issue to set arbitrary metadata.
This issue only affected Ubuntu 14.04 LTS. (CVE-2016-10712)

It was discovered that PHP incorrectly handled the PHAR 404 error page. A
remote attacker could possibly use this issue to conduct cross-site
scripting (XSS) attacks. This issue only affected Ubuntu 16.04 LTS and
Ubuntu 17.10. (CVE-2018-5712)

It was discovered that PHP incorrectly handled parsing certain HTTP
responses. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2018-7584)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS php5 5.5.9+dfsg-1ubuntu4.24
Ubuntu · 16.04 LTS 16.04:LTS php7.0 7.0.28-0ubuntu0.16.04.1

Vulnerabilities 3

  • Unscored —
    CVE-2016-10712

    In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, all of the return values of stream_get_meta_data can b…

    php5 Ubuntu
  • Unscored —
    CVE-2018-5712 EPSS 80%

    An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There i…

    php5 php7.0 php7 php5 Ubuntu Alpine
  • Unscored —
    CVE-2018-7584 Public exploit EPSS 87%

    In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffe…

    php5 php7.0 php7.2 php7 Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2016-10712
  • report
    https://ubuntu.com/security/CVE-2018-5712
  • report
    https://ubuntu.com/security/CVE-2018-7584