7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The php55 packages provide a recent stable release of PHP with the PEAR 1.9.4, memcache 3.0.8, and mongo 1.4.5 PECL extensions, and a number of additional utilities. The php55 packages have been upgraded to upstream version 5.5.21, which provides multiple bug fixes over the version shipped in Red Hat Software Collections 1. (BZ#1057089) The following security issues were fixed in the php55-php component: An uninitialized pointer use flaw was found in PHP’s Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application. (CVE-2015-0232) Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2014-8142, CVE-2015-0231, CVE-2015-0273, CVE-2015-2787, CVE-2015-4147, CVE-2015-4148) A heap buffer overflow flaw was found in the enchant_broker_request_dict() function of PHP’s enchant extension. An attacker able to make a PHP application enchant dictionaries could possibly cause it to crash. (CVE-2014-9705) A heap buffer overflow flaw was found in PHP’s regular expression extension. An attacker able to make PHP process a specially crafted regular expression pattern could cause it to crash and possibly execute arbitrary code. (CVE-2015-2305) A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted GIF file could cause a PHP application using the imagecreatefromgif() function to crash. (CVE-2014-9709) A use-after-free flaw was found in PHP’s OPcache extension. This flaw could possibly lead to a disclosure of a portion of the server memory. (CVE-2015-1351) A use-after-free flaw was found in PHP’s phar (PHP Archive) extension. An attacker able to trigger certain error condition in phar archive processing could possibly use this flaw to disclose certain portions of server memory. (CVE-2015-2301) An ouf-of-bounds read flaw was found in the way the File Information (fileinfo) extension processed certain Pascal strings. A remote attacker could cause a PHP application to crash if it used fileinfo to identify the type of the attacker-supplied file. (CVE-2014-9652) It was found that PHP move_uploaded_file() function did not properly handle file names with a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-2348) A NULL pointer dereference flaw was found in PHP’s pgsql extension. A specially crafted table name passed to a function such as pg_insert() or pg_select() could cause a PHP application to crash. (CVE-2015-1352) A flaw was found in the way PHP handled malformed source files when running in CGI mode. A specially crafted PHP file could cause PHP CGI to crash. (CVE-2014-9427) All php55 users are advised to upgrade to these updated packages, which correct these issues. After installing the updated packages, the httpd24-httpd service must be restarted for the update to take effect.
advisories.mageia.org/MGASA-2015-0040.html
advisories.mageia.org/MGASA-2015-0040.html
lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
lists.opensuse.org/opensuse-security-announce/2015-02/msg00029.html
lists.opensuse.org/opensuse-security-announce/2015-02/msg00029.html
lists.opensuse.org/opensuse-updates/2015-02/msg00079.html
lists.opensuse.org/opensuse-updates/2015-02/msg00079.html
marc.info/?l=bugtraq&m=143403519711434&w=2
marc.info/?l=bugtraq&m=143403519711434&w=2
marc.info/?l=bugtraq&m=143748090628601&w=2
marc.info/?l=bugtraq&m=143748090628601&w=2
marc.info/?l=bugtraq&m=144050155601375&w=2
marc.info/?l=bugtraq&m=144050155601375&w=2
rhn.redhat.com/errata/RHSA-2015-1053.html
rhn.redhat.com/errata/RHSA-2015-1053.html
rhn.redhat.com/errata/RHSA-2015-1066.html
rhn.redhat.com/errata/RHSA-2015-1066.html
rhn.redhat.com/errata/RHSA-2015-1135.html
rhn.redhat.com/errata/RHSA-2015-1135.html
www.debian.org/security/2015/dsa-3195
www.debian.org/security/2015/dsa-3195
www.mandriva.com/security/advisories?name=MDVSA-2015:032
www.mandriva.com/security/advisories?name=MDVSA-2015:032
www.mandriva.com/security/advisories?name=MDVSA-2015:079
www.mandriva.com/security/advisories?name=MDVSA-2015:079
www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
www.php.net/ChangeLog-5.php
www.php.net/ChangeLog-5.php
www.securityfocus.com/bid/72539
www.securityfocus.com/bid/72539
access.redhat.com/security/updates/classification/#moderate
bugs.php.net/bug.php?id=68710
bugs.php.net/bug.php?id=68710
bugzilla.redhat.com/show_bug.cgi?id=1132446
bugzilla.redhat.com/show_bug.cgi?id=1185397
bugzilla.redhat.com/show_bug.cgi?id=1185397
github.com/php/php-src/commit/b585a3aed7880a5fa5c18e2b838fc96f40e075bd
github.com/php/php-src/commit/b585a3aed7880a5fa5c18e2b838fc96f40e075bd
rhn.redhat.com/errata/RHSA-2015-1053.html
security.gentoo.org/glsa/201503-03
security.gentoo.org/glsa/201503-03
security.gentoo.org/glsa/201606-10
security.gentoo.org/glsa/201606-10
support.apple.com/HT205267
support.apple.com/HT205267