[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[SECURITY] [DLA 1397-1] php5 security update

Package        : php5
Version        : 5.6.36+dfsg-0+deb8u1
CVE ID         : CVE-2018-7584 CVE-2018-10545 CVE-2018-10546 CVE-2018-10547 
                 CVE-2018-10548 CVE-2018-10549

Several vulnerabilities were found in PHP, a widely-used open source
general purpose scripting language:


A stack-buffer-overflow while parsing HTTP response results in copying a
large string and possible memory corruption and/or denial of service


Dumpable FPM child processes allow bypassing opcache access controls
resulting in potential information disclosure where one user can obtain
information about another user's running PHP applications


An invalid sequence of bytes can trigger an infinite loop in the stream
filter convert.iconv


A previous fix for CVE-2018-5712 may not be complete, resulting in an
additional vulnerability in the form of a reflected XSS in the PHAR 403
and 404 error pages


A malicious remote LDAP server can send a crafted response that will
cause a denial of service (NULL pointer dereference resulting in an
application crash)


A crafted JPEG file can case an out-of-bounds read and heap buffer

For Debian 8 "Jessie", these problems have been fixed in version

We recommend that you upgrade your php5 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

Attachment: signature.asc
Description: PGP signature

Reply to: