Lucene search

K
ubuntuUbuntuUSN-2952-2
HistoryApr 27, 2016 - 12:00 a.m.

PHP regression

2016-04-2700:00:00
ubuntu.com
50

CVSS2

10

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.9

Confidence

Low

EPSS

0.114

Percentile

95.2%

Releases

  • Ubuntu 15.10

Packages

  • php5 - HTML-embedded scripting language interpreter

Details

USN-2952-1 fixed vulnerabilities in PHP. One of the backported patches
caused a regression in the PHP Soap client. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that the PHP Zip extension incorrectly handled
directories when processing certain zip files. A remote attacker could
possibly use this issue to create arbitrary directories. (CVE-2014-9767)

It was discovered that the PHP Soap client incorrectly validated data
types. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2015-8835, CVE-2016-3185)

It was discovered that the PHP MySQL native driver incorrectly handled TLS
connections to MySQL databases. A machine-in-the-middle attacker could possibly
use this issue to downgrade and snoop on TLS connections. This
vulnerability is known as BACKRONYM. (CVE-2015-8838)

It was discovered that PHP incorrectly handled the imagerotate function. A
remote attacker could use this issue to cause PHP to crash, resulting in a
denial of service, or possibly obtain sensitive information. This issue
only applied to Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2016-1903)

Hans Jerry Illikainen discovered that the PHP phar extension incorrectly
handled certain tar archives. A remote attacker could use this issue to
cause PHP to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2016-2554)

It was discovered that the PHP WDDX extension incorrectly handled certain
malformed XML data. A remote attacker could possibly use this issue to
cause PHP to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2016-3141)

It was discovered that the PHP phar extension incorrectly handled certain
zip files. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly obtain sensitive information.
(CVE-2016-3142)

It was discovered that the PHP libxml_disable_entity_loader() setting was
shared between threads. When running under PHP-FPM, this could result in
XML external entity injection and entity expansion issues. This issue only
applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (No CVE number)

It was discovered that the PHP openssl_random_pseudo_bytes() function did
not return cryptographically strong pseudo-random bytes. (No CVE number)

It was discovered that the PHP Fileinfo component incorrectly handled
certain magic files. An attacker could use this issue to cause PHP to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE number pending)

It was discovered that the PHP php_snmp_error() function incorrectly
handled string formatting. A remote attacker could use this issue to cause
PHP to crash, resulting in a denial of service, or possibly execute
arbitrary code. This issue only applied to Ubuntu 14.04 LTS and Ubuntu
15.10. (CVE number pending)

It was discovered that the PHP rawurlencode() function incorrectly handled
large strings. A remote attacker could use this issue to cause PHP to
crash, resulting in a denial of service. (CVE number pending)

It was discovered that the PHP phar extension incorrectly handled certain
filenames in archives. A remote attacker could use this issue to cause PHP
to crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE number pending)

It was discovered that the PHP mb_strcut() function incorrectly handled
string formatting. A remote attacker could use this issue to cause PHP to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE number pending)

OSVersionArchitecturePackageVersionFilename
Ubuntu15.10noarchlibapache2-mod-php5< 5.6.11+dfsg-1ubuntu3.3UNKNOWN
Ubuntu15.10noarchlibapache2-mod-php5-dbgsym< 5.6.11+dfsg-1ubuntu3.3UNKNOWN
Ubuntu15.10noarchlibapache2-mod-php5filter< 5.6.11+dfsg-1ubuntu3.3UNKNOWN
Ubuntu15.10noarchlibapache2-mod-php5filter-dbgsym< 5.6.11+dfsg-1ubuntu3.3UNKNOWN
Ubuntu15.10noarchlibphp5-embed< 5.6.11+dfsg-1ubuntu3.3UNKNOWN
Ubuntu15.10noarchlibphp5-embed-dbgsym< 5.6.11+dfsg-1ubuntu3.3UNKNOWN
Ubuntu15.10noarchphp-pear< 5.6.11+dfsg-1ubuntu3.3UNKNOWN
Ubuntu15.10noarchphp5< 5.6.11+dfsg-1ubuntu3.3UNKNOWN
Ubuntu15.10noarchphp5-cgi< 5.6.11+dfsg-1ubuntu3.3UNKNOWN
Ubuntu15.10noarchphp5-cgi-dbgsym< 5.6.11+dfsg-1ubuntu3.3UNKNOWN
Rows per page:
1-10 of 591

CVSS2

10

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.9

Confidence

Low

EPSS

0.114

Percentile

95.2%