5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.959 High
EPSS
Percentile
99.5%
Updated php packages fix security vulnerabilities: It was discovered that the file utility contains a flaw in the handling of βindirectβ magic rules in the libmagic library, which leads to an infinite recursion when trying to determine the file type of certain files (CVE-2014-1943). A flaw was found in the way the file utility determined the type of Portable Executable (PE) format files, the executable format used on Windows. A malicious PE file could cause the file utility to crash or, potentially, execute arbitrary code (CVE-2014-2270). PHP contains a bundled copy of the file utilityβs libmagic library, so it was vulnerable to these issues. It has been updated to version 5.5.10, which fixes these issues and several other bugs. Also, the jsonc, xdebug, and timezonedb PHP PECL modules have been updated to their newest versions. Additionally, php-apc has been rebuilt against the updated php package.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Mageia | 4 | noarch | php | <Β 5.5.10-1 | php-5.5.10-1.mga4 |
Mageia | 4 | noarch | php-apc | <Β 3.1.15-4.1 | php-apc-3.1.15-4.1.mga4 |
Mageia | 4 | noarch | php-timezonedb | <Β 2014.1-1 | php-timezonedb-2014.1-1.mga4 |
Mageia | 4 | noarch | php-xdebug | <Β 2.2.4-1 | php-xdebug-2.2.4-1.mga4 |
advisories.mageia.org/MGASA-2014-0092.html
advisories.mageia.org/MGASA-2014-0123.html
pecl.php.net/package-changelog.php?package=jsonc&release=1.3.4
pecl.php.net/package-changelog.php?package=timezonedb&release=2013.9
pecl.php.net/package-changelog.php?package=xdebug&release=2.2.4
www.php.net/ChangeLog-5.php#5.5.10
www.php.net/ChangeLog-5.php#5.5.9
bugs.mageia.org/show_bug.cgi?id=12842