Lucene search

K
mageiaGentoo FoundationMGASA-2020-0119
HistoryMar 06, 2020 - 7:13 p.m.

Updated php packages fix bugs and security vulnerabilities

2020-03-0619:13:58
Gentoo Foundation
advisories.mageia.org
22

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

0.006 Low

EPSS

Percentile

77.7%

Updated php packages fix bugs and security vulnerabilities: Core: - Fixed bug #71876 (Memory corruption htmlspecialchars(): charset `*’ not supported). - Fixed bug #79146 (cscript can fail to run on some systems). - Fixed bug #78323 (Code 0 is returned on invalid options). - Fixed bug #76047 (Use-after-free when accessing already destructed backtrace arguments). CURL: - Fixed bug #79078 (Hypothetical use-after-free in curl_multi_add_handle()). Intl: - Fixed bug #79212 (NumberFormatter::format() may detect wrong type). Libxml: - Fixed bug #79191 (Error in SoapClient ctor disables DOMDocument::save()). MBString: - Fixed bug #79154 (mb_convert_encoding() can modify $from_encoding). MySQLnd: - Fixed bug #79084 (mysqlnd may fetch wrong column indexes with MYSQLI_BOTH). OpenSSL: - Fixed bug #79145 (openssl memory leak). Phar: - Fixed bug #79082 (Files added to tar with Phar::buildFromIterator have all-access permissions). (CVE-2020-7063) - Fixed bug #79171 (heap-buffer-overflow in phar_extract_file). (CVE-2020-7061) - Fixed bug #76584 (PharFileInfo::decompress not working). Reflection: - Fixed bug #79115 (ReflectionClass::isCloneable call reflected class __destruct). Session: - Fixed bug #79221 (Null Pointer Dereference in PHP Session Upload Progress). (CVE-2020-7062) SPL: - Fixed bug #79151 (heap use after free caused by spl_dllist_it_helper_move_forward). Standard: - Fixed bug #78902 (Memory leak when using stream_filter_append). XSL: - Fixed bug #70078 (XSL callbacks with nodes as parameter leak memory).

OSVersionArchitecturePackageVersionFilename
Mageia7noarchphp< 7.3.15-1php-7.3.15-1.mga7

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

0.006 Low

EPSS

Percentile

77.7%