php security update

2018-03-1001:07:54

CentOS Project

lists.centos.org

143

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.298 Low

EPSS

Percentile

96.9%

JSON

CentOS Errata and Security Advisory CESA-2018:0406

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

php: Buffer over-read from unitialized data in gdImageCreateFromGifCtx function (CVE-2017-7890)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2018-March/084934.html

Affected packages:
php
php-bcmath
php-cli
php-common
php-dba
php-devel
php-embedded
php-enchant
php-fpm
php-gd
php-intl
php-ldap
php-mbstring
php-mysql
php-mysqlnd
php-odbc
php-pdo
php-pgsql
php-process
php-pspell
php-recode
php-snmp
php-soap
php-xml
php-xmlrpc

Upstream details at:
https://access.redhat.com/errata/RHSA-2018:0406

OSVersionArchitecturePackageVersionFilename
CentOS7x86_64php< 5.4.16-43.el7_4.1php-5.4.16-43.el7_4.1.x86_64.rpm
CentOS7x86_64php-bcmath< 5.4.16-43.el7_4.1php-bcmath-5.4.16-43.el7_4.1.x86_64.rpm
CentOS7x86_64php-cli< 5.4.16-43.el7_4.1php-cli-5.4.16-43.el7_4.1.x86_64.rpm
CentOS7x86_64php-common< 5.4.16-43.el7_4.1php-common-5.4.16-43.el7_4.1.x86_64.rpm
CentOS7x86_64php-dba< 5.4.16-43.el7_4.1php-dba-5.4.16-43.el7_4.1.x86_64.rpm
CentOS7x86_64php-devel< 5.4.16-43.el7_4.1php-devel-5.4.16-43.el7_4.1.x86_64.rpm
CentOS7x86_64php-embedded< 5.4.16-43.el7_4.1php-embedded-5.4.16-43.el7_4.1.x86_64.rpm
CentOS7x86_64php-enchant< 5.4.16-43.el7_4.1php-enchant-5.4.16-43.el7_4.1.x86_64.rpm
CentOS7x86_64php-fpm< 5.4.16-43.el7_4.1php-fpm-5.4.16-43.el7_4.1.x86_64.rpm
CentOS7x86_64php-gd< 5.4.16-43.el7_4.1php-gd-5.4.16-43.el7_4.1.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	7	x86_64	php	< 5.4.16-43.el7_4.1	php-5.4.16-43.el7_4.1.x86_64.rpm
CentOS	7	x86_64	php-bcmath	< 5.4.16-43.el7_4.1	php-bcmath-5.4.16-43.el7_4.1.x86_64.rpm
CentOS	7	x86_64	php-cli	< 5.4.16-43.el7_4.1	php-cli-5.4.16-43.el7_4.1.x86_64.rpm
CentOS	7	x86_64	php-common	< 5.4.16-43.el7_4.1	php-common-5.4.16-43.el7_4.1.x86_64.rpm
CentOS	7	x86_64	php-dba	< 5.4.16-43.el7_4.1	php-dba-5.4.16-43.el7_4.1.x86_64.rpm
CentOS	7	x86_64	php-devel	< 5.4.16-43.el7_4.1	php-devel-5.4.16-43.el7_4.1.x86_64.rpm
CentOS	7	x86_64	php-embedded	< 5.4.16-43.el7_4.1	php-embedded-5.4.16-43.el7_4.1.x86_64.rpm
CentOS	7	x86_64	php-enchant	< 5.4.16-43.el7_4.1	php-enchant-5.4.16-43.el7_4.1.x86_64.rpm
CentOS	7	x86_64	php-fpm	< 5.4.16-43.el7_4.1	php-fpm-5.4.16-43.el7_4.1.x86_64.rpm
CentOS	7	x86_64	php-gd	< 5.4.16-43.el7_4.1	php-gd-5.4.16-43.el7_4.1.x86_64.rpm