Arch Linux alert ASA-201503-25 (php)

From:
    	     
 
Christian Rebischke <chris.rebischke@gmail.com> 
To:
    	     
 
arch-security@archlinux.org 
Subject:
    	     
 
[ASA-201503-25] php: integer overflow 
Date:
    	     
 
Sat, 28 Mar 2015 03:54:54 +0100
Message-ID:
    	     
 
<20150328025453.GA25098@trudy>
Arch Linux Security Advisory ASA-201503-25
=========================================

Severity: high
Date    : 2015-03-28
CVE-ID  : CVE-2015-2331 
Package : php
Type    : integer overflow
Remote  : yes
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

An integer overflow flaw, leading to a heap-based buffer overflow. This could
raise a crash of the application or is possible exploitable.

Resolution
==========

Upgrade to 5.6.7-1.

# pacman -Syu "php>=5.6.7-1"

The problem have been fixed upstream.

Workaround
==========

None.

Description
===========

An integer overflow flaw, leading to a heap-based buffer overflow, was found in
the way libzip, which is embedded in PHP, processed certain ZIP archives. If an
attacker were able to supply a specially crafted ZIP archive to an application
using libzip, it could cause the application to crash or, possibly, execute
arbitrary code.

Impact
======

An attacker could craft a certain ZIP archive to crash or exploit a libzip based 
php application. 

References
==========

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-2331
https://bugs.php.net/bug.php?id=69253
https://security-tracker.debian.org/tracker/CVE-2015-2331
https://marc.info/?s=CVE-2015-2331&l=oss-security
https://www.rapid7.com/db/vulnerabilities/debian-DSA-3198