Ubuntu alert USN-2391-1 (php5)
| From: | Marc Deslauriers <marc.deslauriers@canonical.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-2391-1] php5 vulnerabilities | |
| Date: | Thu, 30 Oct 2014 08:47:59 -0400 | |
| Message-ID: | <5452337F.9070903@canonical.com> |
========================================================================== Ubuntu Security Notice USN-2391-1 October 30, 2014 php5 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.10 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS - Ubuntu 10.04 LTS Summary: Several security issues were fixed in PHP. Software Description: - php5: HTML-embedded scripting language interpreter Details: Symeon Paraschoudis discovered that PHP incorrectly handled the mkgmtime function. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2014-3668) Symeon Paraschoudis discovered that PHP incorrectly handled unserializing objects. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2014-3669) Otto Ebeling discovered that PHP incorrectly handled the exif_thumbnail function. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-3670) Francisco Alonso that PHP incorrectly handled ELF files in the fileinfo extension. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2014-3710) It was discovered that PHP incorrectly handled NULL bytes when processing certain URLs with the curl functions. A remote attacker could possibly use this issue to bypass filename restrictions and obtain access to sensitive files. (No CVE number) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.10: libapache2-mod-php5 5.5.12+dfsg-2ubuntu4.1 php5-cgi 5.5.12+dfsg-2ubuntu4.1 php5-cli 5.5.12+dfsg-2ubuntu4.1 php5-curl 5.5.12+dfsg-2ubuntu4.1 php5-fpm 5.5.12+dfsg-2ubuntu4.1 php5-xmlrpc 5.5.12+dfsg-2ubuntu4.1 Ubuntu 14.04 LTS: libapache2-mod-php5 5.5.9+dfsg-1ubuntu4.5 php5-cgi 5.5.9+dfsg-1ubuntu4.5 php5-cli 5.5.9+dfsg-1ubuntu4.5 php5-curl 5.5.9+dfsg-1ubuntu4.5 php5-fpm 5.5.9+dfsg-1ubuntu4.5 php5-xmlrpc 5.5.9+dfsg-1ubuntu4.5 Ubuntu 12.04 LTS: libapache2-mod-php5 5.3.10-1ubuntu3.15 php5-cgi 5.3.10-1ubuntu3.15 php5-cli 5.3.10-1ubuntu3.15 php5-curl 5.3.10-1ubuntu3.15 php5-fpm 5.3.10-1ubuntu3.15 php5-xmlrpc 5.3.10-1ubuntu3.15 Ubuntu 10.04 LTS: libapache2-mod-php5 5.3.2-1ubuntu4.28 php5-cgi 5.3.2-1ubuntu4.28 php5-cli 5.3.2-1ubuntu4.28 php5-curl 5.3.2-1ubuntu4.28 php5-xmlrpc 5.3.2-1ubuntu4.28 In general, a standard system update will make all the necessary changes. References: http://www.ubuntu.com/usn/usn-2391-1 CVE-2014-3668, CVE-2014-3669, CVE-2014-3670, CVE-2014-3710 Package Information: https://launchpad.net/ubuntu/+source/php5/5.5.12+dfsg-2ub... https://launchpad.net/ubuntu/+source/php5/5.5.9+dfsg-1ubu... https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.15 https://launchpad.net/ubuntu/+source/php5/5.3.2-1ubuntu4.28 -- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security...