[DLA-0018-1] php5 security update

2014-07-2319:10:58

lists.debian.org

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.9

Confidence

Low

EPSS

0.814

Percentile

98.4%

JSON

Package : php5
Version : 5.3.3-7+squeeze20
CVE ID : CVE-2014-3515 CVE-2014-0207 CVE-2014-3480 CVE-2014-4721

[CVE-2014-3515]: fix unserialize() SPL ArrayObject / SPLObjectStorage
Type Confusion
[CVE-2014-0207]: fileinfo: cdf_read_short_sector insufficient
boundary check
[CVE-2014-3480]: fileinfo: cdf_count_chain insufficient boundary check
[CVE-2014-4721]: The phpinfo implementation in ext/standard/info.c in
PHP before 5.4.30 and 5.5.x before 5.5.14 does not
ensure use of the string data type for the PHP_AUTH_PW,
PHP_AUTH_TYPE, PHP_AUTH_USER, and PHP_SELF variables,
which might allow context-dependent attackers to obtain
sensitive information from process memory by using the
integer data type with crafted values, related to a
"type confusion" vulnerability, as demonstrated by
reading a private SSL key in an Apache HTTP Server
web-hosting environment with mod_ssl and a
PHP 5.3.x mod_php.

OSVersionArchitecturePackageVersionFilename
Debian7kfreebsd-amd64php5-odbc< 5.4.4-14+deb7u12php5-odbc_5.4.4-14+deb7u12_kfreebsd-amd64.deb
Debian7powerpcphp5-snmp< 5.4.4-14+deb7u12php5-snmp_5.4.4-14+deb7u12_powerpc.deb
Debian7armhfphp5-sqlite< 5.4.4-14+deb7u12php5-sqlite_5.4.4-14+deb7u12_armhf.deb
Debian7mipsphp5-sybase< 5.4.4-14+deb7u12php5-sybase_5.4.4-14+deb7u12_mips.deb
Debian7amd64php5-mcrypt< 5.4.4-14+deb7u12php5-mcrypt_5.4.4-14+deb7u12_amd64.deb
Debian7ia64libapache2-mod-php5filter< 5.4.4-14+deb7u12libapache2-mod-php5filter_5.4.4-14+deb7u12_ia64.deb
Debian7s390php5-mcrypt< 5.4.4-14+deb7u12php5-mcrypt_5.4.4-14+deb7u12_s390.deb
Debian7armelphp5-ldap< 5.4.4-14+deb7u12php5-ldap_5.4.4-14+deb7u12_armel.deb
Debian6amd64php5-dbg< 5.3.3-7+squeeze21php5-dbg_5.3.3-7+squeeze21_amd64.deb
Debian7kfreebsd-i386php5-curl< 5.4.4-14+deb7u12php5-curl_5.4.4-14+deb7u12_kfreebsd-i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	kfreebsd-amd64	php5-odbc	< 5.4.4-14+deb7u12	php5-odbc_5.4.4-14+deb7u12_kfreebsd-amd64.deb
Debian	7	powerpc	php5-snmp	< 5.4.4-14+deb7u12	php5-snmp_5.4.4-14+deb7u12_powerpc.deb
Debian	7	armhf	php5-sqlite	< 5.4.4-14+deb7u12	php5-sqlite_5.4.4-14+deb7u12_armhf.deb
Debian	7	mips	php5-sybase	< 5.4.4-14+deb7u12	php5-sybase_5.4.4-14+deb7u12_mips.deb
Debian	7	amd64	php5-mcrypt	< 5.4.4-14+deb7u12	php5-mcrypt_5.4.4-14+deb7u12_amd64.deb
Debian	7	ia64	libapache2-mod-php5filter	< 5.4.4-14+deb7u12	libapache2-mod-php5filter_5.4.4-14+deb7u12_ia64.deb
Debian	7	s390	php5-mcrypt	< 5.4.4-14+deb7u12	php5-mcrypt_5.4.4-14+deb7u12_s390.deb
Debian	7	armel	php5-ldap	< 5.4.4-14+deb7u12	php5-ldap_5.4.4-14+deb7u12_armel.deb
Debian	6	amd64	php5-dbg	< 5.3.3-7+squeeze21	php5-dbg_5.3.3-7+squeeze21_amd64.deb
Debian	7	kfreebsd-i386	php5-curl	< 5.4.4-14+deb7u12	php5-curl_5.4.4-14+deb7u12_kfreebsd-i386.deb