Lucene search

K
centosCentOS ProjectCESA-2017:3221
HistoryNov 15, 2017 - 9:26 p.m.

php security update

2017-11-1521:26:52
CentOS Project
lists.centos.org
69

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.018 Low

EPSS

Percentile

87.8%

CentOS Errata and Security Advisory CESA-2017:3221

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

  • A null pointer dereference flaw was found in libgd. An attacker could use a specially-crafted .gd2 file to cause an application linked with libgd to crash, leading to denial of service. (CVE-2016-10167)

  • An integer overflow flaw, leading to a heap-based buffer overflow was found in the way libgd read some specially-crafted gd2 files. A remote attacker could use this flaw to crash an application compiled with libgd or in certain cases execute arbitrary code with the privileges of the user running that application. (CVE-2016-10168)

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2017-November/084775.html

Affected packages:
php
php-bcmath
php-cli
php-common
php-dba
php-devel
php-embedded
php-enchant
php-fpm
php-gd
php-intl
php-ldap
php-mbstring
php-mysql
php-mysqlnd
php-odbc
php-pdo
php-pgsql
php-process
php-pspell
php-recode
php-snmp
php-soap
php-xml
php-xmlrpc

Upstream details at:
https://access.redhat.com/errata/RHSA-2017:3221

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.018 Low

EPSS

Percentile

87.8%

Related for CESA-2017:3221