Scientific Linux alert SLSA-2016:1613-1 (php)

From:
    	     
 
Kevin Hill <kevinh@fnal.gov> 
To:
    	     
 
<scientific-linux-errata@listserv.fnal.gov> 
Subject:
    	     
 
Security ERRATA Moderate: php on SL7.x x86_64 
Date:
    	     
 
Tue, 16 Aug 2016 20:55:17 +0000
Message-ID:
    	     
 
<20160816205517.14867.89897@slpackages.fnal.gov>
Synopsis:          Moderate: php security and bug fix update
Advisory ID:       SLSA-2016:1613-1
Issue Date:        2016-08-11
CVE Numbers:       CVE-2016-5385
--

Security Fix(es):

* It was discovered that PHP did not properly protect against the
HTTP_PROXY variable name clash. A remote attacker could possibly use this
flaw to redirect HTTP requests performed by a PHP script to an attacker-
controlled proxy via a malicious HTTP request. (CVE-2016-5385)

Bug Fix(es):

* Previously, an incorrect logic in the SAPI header callback routine
caused that the callback counter was not incremented. Consequently, when a
script included a header callback, it could terminate unexpectedly with a
segmentation fault. With this update, the callback counter is properly
managed, and scripts with a header callback implementation work as
expected.
--

SL7
  x86_64
    php-5.4.16-36.3.el7_2.x86_64.rpm
    php-bcmath-5.4.16-36.3.el7_2.x86_64.rpm
    php-cli-5.4.16-36.3.el7_2.x86_64.rpm
    php-common-5.4.16-36.3.el7_2.x86_64.rpm
    php-dba-5.4.16-36.3.el7_2.x86_64.rpm
    php-debuginfo-5.4.16-36.3.el7_2.x86_64.rpm
    php-devel-5.4.16-36.3.el7_2.x86_64.rpm
    php-embedded-5.4.16-36.3.el7_2.x86_64.rpm
    php-enchant-5.4.16-36.3.el7_2.x86_64.rpm
    php-fpm-5.4.16-36.3.el7_2.x86_64.rpm
    php-gd-5.4.16-36.3.el7_2.x86_64.rpm
    php-intl-5.4.16-36.3.el7_2.x86_64.rpm
    php-ldap-5.4.16-36.3.el7_2.x86_64.rpm
    php-mbstring-5.4.16-36.3.el7_2.x86_64.rpm
    php-mysql-5.4.16-36.3.el7_2.x86_64.rpm
    php-mysqlnd-5.4.16-36.3.el7_2.x86_64.rpm
    php-odbc-5.4.16-36.3.el7_2.x86_64.rpm
    php-pdo-5.4.16-36.3.el7_2.x86_64.rpm
    php-pgsql-5.4.16-36.3.el7_2.x86_64.rpm
    php-process-5.4.16-36.3.el7_2.x86_64.rpm
    php-pspell-5.4.16-36.3.el7_2.x86_64.rpm
    php-recode-5.4.16-36.3.el7_2.x86_64.rpm
    php-snmp-5.4.16-36.3.el7_2.x86_64.rpm
    php-soap-5.4.16-36.3.el7_2.x86_64.rpm
    php-xml-5.4.16-36.3.el7_2.x86_64.rpm
    php-xmlrpc-5.4.16-36.3.el7_2.x86_64.rpm

- Scientific Linux Development Team