7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.955 High
EPSS
Percentile
99.4%
Debian Security Advisory DSA-3195-1 [email protected]
http://www.debian.org/security/ Moritz Muehlenhoff
March 18, 2015 http://www.debian.org/security/faq
Package : php5
CVE ID : CVE-2014-9705 CVE-2015-0231 CVE-2015-0232 CVE-2015-0273
CVE-2015-2305
Multiple vulnerabilities have been discovered in the PHP language:
CVE-2015-2305
Guido Vranken discovered a heap overflow in the ereg extension
(only applicable to 32 bit systems).
CVE-2014-9705
Buffer overflow in the enchant extension.
CVE-2015-0231
Stefan Esser discovered a use-after-free in the unserialisation
of objects.
CVE-2015-0232
Alex Eubanks discovered incorrect memory management in the exif
extension.
CVE-2015-0273
Use-after-free in the unserialisation of DateTimeZone.
For the stable distribution (wheezy), these problems have been fixed in
version 5.4.38-0+deb7u1.
For the upcoming stable distribution (jessie), these problems have been
fixed in version 5.6.6+dfsg-2.
For the unstable distribution (sid), these problems have been fixed in
version 5.6.6+dfsg-2.
We recommend that you upgrade your php5 packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: [email protected]
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 7 | kfreebsd-amd64 | libapache2-mod-php5filter | < 5.4.38-0+deb7u1 | libapache2-mod-php5filter_5.4.38-0+deb7u1_kfreebsd-amd64.deb |
Debian | 7 | mips | php5-mcrypt | < 5.4.38-0+deb7u1 | php5-mcrypt_5.4.38-0+deb7u1_mips.deb |
Debian | 7 | ia64 | php5-odbc | < 5.4.38-0+deb7u1 | php5-odbc_5.4.38-0+deb7u1_ia64.deb |
Debian | 7 | mips | php5-odbc | < 5.4.38-0+deb7u1 | php5-odbc_5.4.38-0+deb7u1_mips.deb |
Debian | 7 | sparc | php5-snmp | < 5.4.38-0+deb7u1 | php5-snmp_5.4.38-0+deb7u1_sparc.deb |
Debian | 7 | s390x | php5-ldap | < 5.4.38-0+deb7u1 | php5-ldap_5.4.38-0+deb7u1_s390x.deb |
Debian | 7 | s390x | php5-intl | < 5.4.38-0+deb7u1 | php5-intl_5.4.38-0+deb7u1_s390x.deb |
Debian | 7 | armhf | php5-recode | < 5.4.38-0+deb7u1 | php5-recode_5.4.38-0+deb7u1_armhf.deb |
Debian | 7 | armhf | php5-curl | < 5.4.38-0+deb7u1 | php5-curl_5.4.38-0+deb7u1_armhf.deb |
Debian | 7 | armhf | php5-gd | < 5.4.38-0+deb7u1 | php5-gd_5.4.38-0+deb7u1_armhf.deb |