Debian: DSA-3390-1 Important: Python Remote Code Execution Vulnerabilities

Two vulnerabilities were found in PHP, a general-purpose scripting
language commonly used for web application development.

CVE-2015-7803

The phar extension could crash with a NULL pointer dereference
when processing tar archives containing links referring to
non-existing files. This could lead to a denial of service.

CVE-2015-7804

The phar extension does not correctly process directory entries
found in archive files with the name "/", leading to a denial of
service and, potentially, information disclosure.

The update for Debian stable (jessie) contains additional bug fixes
from PHP upstream version 5.6.14, as described in the upstream
changelog:

https://www.php.net/ChangeLog-5.php

Note to users of the the oldstable distribution (wheezy): PHP 5.4 has
reached end-of-life on September 14th, 2015. As a result, there will
be no more new upstream releases. The security support of PHP 5.4 in
Debian oldstable (wheezy) will be best effort only, and you are
strongly advised to up...