[SECURITY] [DSA 3195-1] php5 security update

2015-03-1811:56:46

lists.debian.org

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

9.3

Confidence

Low

EPSS

0.95

Percentile

99.3%

JSON

Debian Security Advisory DSA-3195-1 [email protected]
http://www.debian.org/security/ Moritz Muehlenhoff
March 18, 2015 http://www.debian.org/security/faq

Package : php5
CVE ID : CVE-2014-9705 CVE-2015-0231 CVE-2015-0232 CVE-2015-0273
CVE-2015-2305

Multiple vulnerabilities have been discovered in the PHP language:

CVE-2015-2305

Guido Vranken discovered a heap overflow in the ereg extension
(only applicable to 32 bit systems).

CVE-2014-9705

Buffer overflow in the enchant extension.

CVE-2015-0231

Stefan Esser discovered a use-after-free in the unserialisation
of objects.

CVE-2015-0232

Alex Eubanks discovered incorrect memory management in the exif
extension.

CVE-2015-0273

Use-after-free in the unserialisation of DateTimeZone.

For the stable distribution (wheezy), these problems have been fixed in
version 5.4.38-0+deb7u1.

For the upcoming stable distribution (jessie), these problems have been
fixed in version 5.6.6+dfsg-2.

For the unstable distribution (sid), these problems have been fixed in
version 5.6.6+dfsg-2.

We recommend that you upgrade your php5 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian6amd64php5-dbg< 5.3.3.1-7+squeeze26php5-dbg_5.3.3.1-7+squeeze26_amd64.deb
Debian7armhflibclamav6< 0.98.7+dfsg-0+deb7u1libclamav6_0.98.7+dfsg-0+deb7u1_armhf.deb
Debian6i386php5-interbase< 5.3.3.1-7+squeeze26php5-interbase_5.3.3.1-7+squeeze26_i386.deb
Debian7sparcphp5-tidy< 5.4.38-0+deb7u1php5-tidy_5.4.38-0+deb7u1_sparc.deb
Debian8amd64clamav-milter< 0.98.7+dfsg-0+deb8u1clamav-milter_0.98.7+dfsg-0+deb8u1_amd64.deb
Debian7amd64php5-common< 5.4.38-0+deb7u1php5-common_5.4.38-0+deb7u1_amd64.deb
Debian6allclamav-testfiles< 0.98.7+dfsg-0+deb6u1clamav-testfiles_0.98.7+dfsg-0+deb6u1_all.deb
Debian7ia64php5-pspell< 5.4.38-0+deb7u1php5-pspell_5.4.38-0+deb7u1_ia64.deb
Debian7kfreebsd-amd64php5-curl< 5.4.38-0+deb7u1php5-curl_5.4.38-0+deb7u1_kfreebsd-amd64.deb
Debian8ppc64elclamav-milter< 0.98.7+dfsg-0+deb8u1clamav-milter_0.98.7+dfsg-0+deb8u1_ppc64el.deb

OS	Version	Architecture	Package	Version	Filename
Debian	6	amd64	php5-dbg	< 5.3.3.1-7+squeeze26	php5-dbg_5.3.3.1-7+squeeze26_amd64.deb
Debian	7	armhf	libclamav6	< 0.98.7+dfsg-0+deb7u1	libclamav6_0.98.7+dfsg-0+deb7u1_armhf.deb
Debian	6	i386	php5-interbase	< 5.3.3.1-7+squeeze26	php5-interbase_5.3.3.1-7+squeeze26_i386.deb
Debian	7	sparc	php5-tidy	< 5.4.38-0+deb7u1	php5-tidy_5.4.38-0+deb7u1_sparc.deb
Debian	8	amd64	clamav-milter	< 0.98.7+dfsg-0+deb8u1	clamav-milter_0.98.7+dfsg-0+deb8u1_amd64.deb
Debian	7	amd64	php5-common	< 5.4.38-0+deb7u1	php5-common_5.4.38-0+deb7u1_amd64.deb
Debian	6	all	clamav-testfiles	< 0.98.7+dfsg-0+deb6u1	clamav-testfiles_0.98.7+dfsg-0+deb6u1_all.deb
Debian	7	ia64	php5-pspell	< 5.4.38-0+deb7u1	php5-pspell_5.4.38-0+deb7u1_ia64.deb
Debian	7	kfreebsd-amd64	php5-curl	< 5.4.38-0+deb7u1	php5-curl_5.4.38-0+deb7u1_kfreebsd-amd64.deb
Debian	8	ppc64el	clamav-milter	< 0.98.7+dfsg-0+deb8u1	clamav-milter_0.98.7+dfsg-0+deb8u1_ppc64el.deb