[SECURITY] [DLA 2261-1] php5 security update
-----BEGIN PGP SIGNED MESSAGE-----
Package : php5
Version : 5.6.40+dfsg-0+deb8u12
CVE ID : CVE-2019-11048
It has been discovered, that a vulnerability in php5, a server-side,
HTML-embedded scripting language, could lead to exhausted disk space on
the server. When using overly long filenames or field names, a memory
limit could be hit which results in stopping the upload but not cleaning
Further the embedded version of "file" is vulnerable to CVE-2019-18218.
As it can not be exploited the same in php5 as in file, this issue is not
handled as an own CVE but just as a bug, that has been fixed here
(restrict the number of CDF_VECTOR elements to prevent a heap-based
buffer overflow (4-byte out-of-bounds write)).
For Debian 8 "Jessie", this problem has been fixed in version
We recommend that you upgrade your php5 packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----