Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

Fedora 23: 2015-14978 Critical PHP Fixes - Use After Free Issues

fedora
Calendar Grey September 18, 2015
Dist Fedora Esm H88
Fedora 23 receives an important security patch for PHP, targeting several severe problems, notably use-after-free vulnerabilities that could lead to system compromise.
03 Sep 2015, **PHP 5.6.13** **Core:** * Fixed bug #69900 (Too long timeout on pipes)

Summary

PHP is an HTML-embedded scripting language. PHP attempts to make it

easy for developers to write dynamically generated web pages. PHP also

offers built-in database integration for several commercial and

non-commercial database management systems, so writing a

database-enabled webpage with PHP is fairly simple. The most common

use of PHP coding is probably as a replacement for CGI scripts.

The php package contains the module (often referred to as mod_php)

which adds support for the PHP language to Apache HTTP Server.

Update Information:

03 Sep 2015, **PHP 5.6.13** **Core:** * Fixed bug #69900 (Too long timeout on pipes). (Anatol) * Fixed bug #69487 (SAPI may truncate POST data). (cmb) * Fixed bug #70198 (Checking liveness does not work as expected). (Shafreeck Sea, Anatol Belski) * Fixed bug #70172 (Use After Free Vulnerability in unserialize()). (Stas) * Fixed bug #70219 (Use after free vulnerability in session deserializer). (taoguangchen at icloud dot com) **CLI server:** * Fixed bug #66606 (Sets HTTP_CONTENT_TYPE but not CONTENT_TYPE). (wusuopu, cmb) * Fixed bug #70264 (CLI server directory traversal). (cmb) **Date:** * Fixed bug #70266 (DateInterval::__construct.interval_spec is not supposed to be optional). (cmb) * Fixed bug #70277 (new DateTimeZone($foo) is ignoring text after null byte). (cmb) **EXIF:** * Fixed bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes). (Stas) **hash:** * Fixed bug #70312 (HAVAL gives wrong hashes in specific cases). (letsgolee at nav...

Topics%20covered

Topics Covered

security advisory critical software update Fedora bug fix PHP use after free

Change Log

References


[ 1 ] Bug #1260711 - CVE-2015-6837 CVE-2015-6838 php: NULL pointer dereference in XSLTProcessor class https://bugzilla.redhat.com/show_bug.cgi?id=1260711 [ 2 ] Bug #1260741 - php: Null pointer deref (segfault) in spl_autoload via ob_start https://bugzilla.redhat.com/show_bug.cgi?id=1260741 [ 3 ] Bug #1260734 - php: new DateTimeZone($foo) is ignoring text after null byte https://bugzilla.redhat.com/show_bug.cgi?id=1260734 [ 4 ] Bug #1260707 - php: Another use-after-free vulnerability in unserialize() with SplDoublyLinkedList https://bugzilla.redhat.com/show_bug.cgi?id=1260707 [ 5 ] Bug #1260671 - php: HAVAL gives wrong hashes in specific cases https://bugzilla.redhat.com/show_bug.cgi?id=1260671 [ 6 ] Bug #1260642 - CVE-2015-6834 php: Use After Free Vulnerability in unserialize() https://bugzilla.redhat.com/show_bug.cgi?id=1260642 [ 7 ] Bug #1260683 - CVE-2015-6836 php: SOAP serialize_function_call() type confusion / RCE ...

Read the Full Advisory

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update php' at the command line. For more information, refer to "Managing Software with yum", available at .

Severity
critical
Lowest
Low
Medium
High
Critical

Name: php
Product: Fedora 23
Version: 5.6.13
Release: 1.fc23
URL: https://www.php.net/
Summary: PHP scripting language for creating dynamic web sites

Topics%20covered

Topics Covered

security advisory critical software update Fedora bug fix PHP use after free

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here