php: multiple issues

2015-04-17T00:00:00
ID ASA-201504-14
Type archlinux
Reporter Arch Linux
Modified 2015-04-17T00:00:00

Description

  • CVE-2015-1351 (denial of service)

Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

  • CVE-2015-1352 (denial of service)

The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension does not validate token extraction for table names, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name.

  • CVE-2015-2783 (out-of-bounds read)

The vulnerability can be triggered when parsing a PHAR file at phar.c:623. The "buf_len" is obtained from the phar file and passed into php_var_unserialize() as the max argument. Under normal php_var_unserialize() circumstances, YYCURSOR will always be <= max. This however can be bypassed when processing a malform phar with a buf_len that is shorter then the string to be unserialized resulting in a memory info leak.