Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 433
Alerts This Week
Warning Icon 1 433

Debian 8 Jessie DLA-1741-1 moderate: php5 DNS Parsing Issues

debian lts
Calendar Grey March 31, 2019
Dist Debian Esm H88
Multiple vulnerabilities in php5 discovered. To ensure security, upgrade to version 5.6.40+dfsg-0+deb8u2 to mitigate related risks.
Several vulnerabilities have been found in php5, a server-side, HTML-embedded scripting language
Topics%20covered

Topics Covered

security advisory access control Debian memory management DNS issues php5

Summary


CVE-2019-9637
rename() across the device may allow unwanted access during
processing.

CVE-2019-9638, CVE-2019-9639
Uninitialized read in exif_process_IFD_in_MAKERNOTE.

CVE-2019-9640
Invalid Read on exif_process_SOFn.

CVE-2019-9641
Uninitialized read in exif_process_IFD_in_TIFF.

CVE-2019-9022
An issue during parsing of DNS responses allows a hostile DNS server
to misuse memcpy, which leads to a read operation past an allocated
buffer.


For Debian 8 "Jessie", these problems have been fixed in version
5.6.40+dfsg-0+deb8u2.

We recommend that you upgrade your php5 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS



Package: php5
Version: 5.6.40+dfsg-0+deb8u2
CVE ID: CVE-2019-9022 CVE-2019-9637 CVE-2019-9638 CVE-2019-9639

Topics%20covered

Topics Covered

security advisory access control Debian memory management DNS issues php5

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.