9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.242 Low
EPSS
Percentile
96.5%
CentOS Errata and Security Advisory CESA-2016:2598
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.
Security Fix(es):
A flaw was found in the way certain error conditions were handled by bzread() function in PHP. An attacker could use this flaw to upload a specially crafted bz2 archive which, when parsed via the vulnerable function, could cause the application to crash or execute arbitrary code with the permissions of the user running the PHP application. (CVE-2016-5399)
An integer overflow flaw, leading to a heap-based buffer overflow was found in the imagecreatefromgd2() function of PHP’s gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application using gd via a specially crafted GD2 image. (CVE-2016-5766)
An integer overflow flaw, leading to a heap-based buffer overflow was found in the gdImagePaletteToTrueColor() function of PHP’s gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application using gd via a specially crafted image buffer. (CVE-2016-5767)
A double free flaw was found in the mb_ereg_replace_callback() function of php which is used to perform regex search. This flaw could possibly cause a PHP application to crash. (CVE-2016-5768)
Red Hat would like to thank Hans Jerry Illikainen for reporting CVE-2016-5399.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-cr-announce/2016-November/029693.html
Affected packages:
php
php-bcmath
php-cli
php-common
php-dba
php-devel
php-embedded
php-enchant
php-fpm
php-gd
php-intl
php-ldap
php-mbstring
php-mysql
php-mysqlnd
php-odbc
php-pdo
php-pgsql
php-process
php-pspell
php-recode
php-snmp
php-soap
php-xml
php-xmlrpc
Upstream details at:
https://access.redhat.com/errata/RHSA-2016:2598
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
CentOS | 7 | x86_64 | php | < 5.4.16-42.el7 | php-5.4.16-42.el7.x86_64.rpm |
CentOS | 7 | x86_64 | php-bcmath | < 5.4.16-42.el7 | php-bcmath-5.4.16-42.el7.x86_64.rpm |
CentOS | 7 | x86_64 | php-cli | < 5.4.16-42.el7 | php-cli-5.4.16-42.el7.x86_64.rpm |
CentOS | 7 | x86_64 | php-common | < 5.4.16-42.el7 | php-common-5.4.16-42.el7.x86_64.rpm |
CentOS | 7 | x86_64 | php-dba | < 5.4.16-42.el7 | php-dba-5.4.16-42.el7.x86_64.rpm |
CentOS | 7 | x86_64 | php-devel | < 5.4.16-42.el7 | php-devel-5.4.16-42.el7.x86_64.rpm |
CentOS | 7 | x86_64 | php-embedded | < 5.4.16-42.el7 | php-embedded-5.4.16-42.el7.x86_64.rpm |
CentOS | 7 | x86_64 | php-enchant | < 5.4.16-42.el7 | php-enchant-5.4.16-42.el7.x86_64.rpm |
CentOS | 7 | x86_64 | php-fpm | < 5.4.16-42.el7 | php-fpm-5.4.16-42.el7.x86_64.rpm |
CentOS | 7 | x86_64 | php-gd | < 5.4.16-42.el7 | php-gd-5.4.16-42.el7.x86_64.rpm |
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.242 Low
EPSS
Percentile
96.5%