Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

openSUSE 13.2/13.1: 2015:0440-1 Important: php5 Use After Free

opensuse
Calendar Grey March 6, 2015
Scroller Opensuse
The latest php5 patch in openSUSE addresses critical security flaws that require immediate action.
An update that fixes two vulnerabilities is now available

Description

php5 was updated to fix two security issues.

These security issues were fixed:

- CVE-2014-9652: Out of bounds read in mconvert() (bnc#917150).

- CVE-2015-0273: Use after free vulnerability in unserialize() with

DateTimeZone (bnc#918768).

Topics%20covered

Topics Covered

security advisory security update important out of bounds php5 openSUSE use after free

Patch

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

- openSUSE 13.2:

zypper in -t patch openSUSE-2015-203=1

- openSUSE 13.1:

zypper in -t patch openSUSE-2015-203=1

To bring your system up-to-date, use "zypper patch".

Package List

- openSUSE 13.2 (aarch64 armv7hl ppc ppc64 ppc64le):

apache2-mod_php5-5.6.1-12.1

apache2-mod_php5-debuginfo-5.6.1-12.1

php5-5.6.1-12.1

php5-bcmath-5.6.1-12.1

php5-bcmath-debuginfo-5.6.1-12.1

php5-bz2-5.6.1-12.1

php5-bz2-debuginfo-5.6.1-12.1

php5-calendar-5.6.1-12.1

php5-calendar-debuginfo-5.6.1-12.1

php5-ctype-5.6.1-12.1

php5-ctype-debuginfo-5.6.1-12.1

php5-curl-5.6.1-12.1

php5-curl-debuginfo-5.6.1-12.1

php5-dba-5.6.1-12.1

php5-dba-debuginfo-5.6.1-12.1

php5-debuginfo-5.6.1-12.1

php5-debugsource-5.6.1-12.1

php5-devel-5.6.1-12.1

php5-dom-5.6.1-12.1

php5-dom-debuginfo-5.6.1-12.1

php5-enchant-5.6.1-12.1

php5-enchant-debuginfo-5.6.1-12.1

php5-exif-5.6.1-12.1

php5-exif-debuginfo-5.6.1-12.1

php5-fastcgi-5.6.1-12.1

php5-fastcgi-debuginfo-5.6.1-12.1

php5-fileinfo-5.6.1-12.1

php5-fileinfo-debuginfo-5.6.1-12.1

php5-firebird-5.6.1-12.1

php5-firebird-debuginfo-5.6.1-12.1

php5-fpm-5.6.1-12.1

php5-fpm-debuginfo-5.6.1-12.1

php5-ftp-5.6.1-12.1

php5-ftp-debuginfo-5.6.1-12.1

php5-gd-5.6.1-12.1

php5-gd-debuginfo-5.6.1-12.1

php5-gettext-5.6.1...

Read the Full Advisory

References

https://www.suse.com/security/cve/CVE-2014-9652.html

https://www.suse.com/security/cve/CVE-2015-0273.html

https://bugzilla.suse.com/show_bug.cgi?id=917150

https://bugzilla.suse.com/show_bug.cgi?id=918768

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2015:0440-1
Rating: important
Affected Products: openSUSE 13.2 openSUSE 13.1 .

Topics%20covered

Topics Covered

security advisory security update important out of bounds php5 openSUSE use after free

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.