Ubuntu 14.04 LTS : PHP vulnerabilities (USN-2572-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2572-1 advisory. It was discovered that PHP incorrectly handled cleanup when used with Apache 2.4. A remote attacker could use this issue to cause PHP to crash, resulting...

USN-2572-1 php5 vulnerabilities

It was discovered that PHP incorrectly handled cleanup when used with Apache 2.4. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2015-3330 It was discovered that PHP incorrectly handled opening tar, zip or ph...

OpenJDK: jar directory traversal issues (Tools, 8064601)

A directory traversal flaw was found in the way the jar tool extracted JAR archive files. A specially crafted JAR archive could cause jar to overwrite arbitrary files writable by the user running jar when the archive was extracted...

[SECURITY] Fedora 22 Update: libzip-0.11.2-5.fc22

libzip is a C library for reading, creating, and modifying zip archives. Fi les can be added from data buffers, files, or compressed data copied directly f rom other zip archives. Changes made without closing the archive can be reverte d. The API is documented by man pages...

Amazon Linux AMI : php54 (ALAS-2015-506)

A use-after-free flaw was found in the way PHP's unserialize function processed data. If a remote attacker was able to pass crafted input to PHP's unserialize function, they could cause the PHP interpreter to crash or, possibly, execute arbitrary code. CVE-2015-0231 An integer overflow flaw,...

Fedora 22 : libzip-0.11.2-5.fc22 (2015-4553)

CVE-2015-2331: integer overflow when processing ZIP archives 1204676,1204677 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Open-source ARJ archiver directory traversal vulnerability (CNVD-2015-02287)

Open-source ARJ archiver is an ARJ archive processing tool. Open-source ARJ archiver fails to properly remove slash notation from paths, allowing attackers to perform absolute path traversal attacks and write arbitrary files via specially crafted ARJ archives...

Open-source ARJ archiver directory traversal vulnerability (CNVD-2015-02288)

Open-source ARJ archiver is an ARJ archive processing tool. Open-source ARJ archiver suffers from a symbolic link vulnerability that allows attackers to construct malicious ARJ archives and trick applications into parsing them, allowing traversal attacks on directories...

Open-source ARJ archiver buffer overflow vulnerability

Open-source ARJ archiver is an ARJ archive processing tool. A buffer overflow vulnerability exists in Open-source ARJ archiver that allows an attacker to trick an application into parsing a specially crafted ARJ archive, which could crash the application or execute arbitrary code...

[SECURITY] Fedora 20 Update: mingw-libzip-0.11.2-3.fc20

libzip is a C library for reading, creating, and modifying zip archives. Fi les can be added from data buffers, files, or compressed data copied directly f rom other zip archives. Changes made without closing the archive can be reverte d. The API is documented by man pages...

[SECURITY] Fedora 21 Update: mingw-libzip-0.11.2-3.fc21

libzip is a C library for reading, creating, and modifying zip archives. Fi les can be added from data buffers, files, or compressed data copied directly f rom other zip archives. Changes made without closing the archive can be reverte d. The API is documented by man pages...

[SECURITY] Fedora 22 Update: mingw-libzip-0.11.2-3.fc22

libzip is a C library for reading, creating, and modifying zip archives. Fi les can be added from data buffers, files, or compressed data copied directly f rom other zip archives. Changes made without closing the archive can be reverte d. The API is documented by man pages...

Mandriva Linux Security Advisory : cpio (MDVSA-2015:066)

Updated cpio package fixes security vulnerability : In GNU Cpio 2.11, the --no-absolute-filenames option limits extracting contents of an archive to be strictly inside a current directory. However, it can be bypassed with symlinks. While extracting an archive, it will extract symlinks and then...

[SECURITY] [DSA 3198-2] php5 regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3198-2 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso March 28, 2015 http://www.debian.org/security/faq -...

php: integer overflow

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way libzip, which is embedded in PHP, processed certain ZIP archives. If an attacker were able to supply a specially crafted ZIP archive to an application using libzip, it could cause the application to crash or,...

DSA-3198-2 php5 - regression update

Bulletin has no description...

Debian DSA-3198-1 : php5 - security update

Multiple vulnerabilities have been discovered in the PHP language : - CVE-2015-2301 Use-after-free in the phar extension. - CVE-2015-2331 Emmanuel Law discovered an integer overflow in the processing of ZIP archives, resulting in denial of service or potentially the execution of arbitrary code...

[SECURITY] [DSA 3198-1] php5 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3198-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff March 20, 2015 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3198-1] php5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3198-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff March 20, 2015 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 3198-1 (php5 - security update)

Multiple vulnerabilities have been discovered in the PHP language: CVE-2015-2301 Use-after-free in the phar extension. CVE-2015-2331 Emmanuel Law discovered an integer overflow in the processing of ZIP archives, resulting in denial of service or potentially the execution of arbitrary code. OpenVA...