Lucene search

K
mageiaGentoo FoundationMGASA-2014-0163
HistoryApr 04, 2014 - 9:33 p.m.

Updated php packages fix security vulnerabilities

2014-04-0421:33:24
Gentoo Foundation
advisories.mageia.org
14

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.959 High

EPSS

Percentile

99.5%

Updated php packages fix security vulnerabilities: It was discovered that the file utility contains a flaw in the handling of β€œindirect” magic rules in the libmagic library, which leads to an infinite recursion when trying to determine the file type of certain files (CVE-2014-1943). A flaw was found in the way the file utility determined the type of Portable Executable (PE) format files, the executable format used on Windows. A malicious PE file could cause the file utility to crash or, potentially, execute arbitrary code (CVE-2014-2270). PHP contains a bundled copy of the file utility’s libmagic library, so it was vulnerable to these issues. It has been updated to version 5.5.10, which fixes these issues and several other bugs. Also, the jsonc, xdebug, and timezonedb PHP PECL modules have been updated to their newest versions. Additionally, php-apc has been rebuilt against the updated php package.

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.959 High

EPSS

Percentile

99.5%