Alerts This Week
Warning Icon 1 666
Alerts This Week
Warning Icon 1 666

openSUSE Leap 42.1 Advisory: Important php5 Security Fixes

opensuse
Calendar Grey April 28, 2016
Dist Opensuse Esm H88
openSUSE Security Patch for php5 addresses various vulnerabilities, enhancing system reliability and safeguarding against threats.
An update that fixes 7 vulnerabilities is now available

Description

This update for php5 fixes the following security issues:

- CVE-2015-8838: mysqlnd was vulnerable to BACKRONYM (bnc#973792).

- CVE-2015-8835: SoapClient s_call method suffered from a type confusion

issue that could have lead to crashes [bsc#973351]

- CVE-2016-2554: A NULL pointer dereference in phar_get_fp_offset could

lead to crashes. [bsc#968284] Note: we do not ship the phar extension

currently, so we are not affected.

- CVE-2016-3141: A use-after-free / double-free in the WDDX

deserialization could lead to crashes or potential code execution.

[bsc#969821]

- CVE-2016-3142: An Out-of-bounds read in phar_parse_zipfile() could lead

to crashes. [bsc#971912] Note: we do not ship the phar extension

currently, so we are not affected.

- CVE-2014-9767: A directory traversal when extracting zip files was fixed

that could lead to

overwritten files. [bsc#971612]

- CVE-2016-3185: A type confusion vulnerability in

...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory code execution important system stability php5 openSUSE exploit protection

Patch

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.1:

zypper in -t patch openSUSE-2016-517=1

To bring your system up-to-date, use "zypper patch".

Package List

- openSUSE Leap 42.1 (i586 x86_64):

apache2-mod_php5-5.5.14-44.1

apache2-mod_php5-debuginfo-5.5.14-44.1

php5-5.5.14-44.1

php5-bcmath-5.5.14-44.1

php5-bcmath-debuginfo-5.5.14-44.1

php5-bz2-5.5.14-44.1

php5-bz2-debuginfo-5.5.14-44.1

php5-calendar-5.5.14-44.1

php5-calendar-debuginfo-5.5.14-44.1

php5-ctype-5.5.14-44.1

php5-ctype-debuginfo-5.5.14-44.1

php5-curl-5.5.14-44.1

php5-curl-debuginfo-5.5.14-44.1

php5-dba-5.5.14-44.1

php5-dba-debuginfo-5.5.14-44.1

php5-debuginfo-5.5.14-44.1

php5-debugsource-5.5.14-44.1

php5-devel-5.5.14-44.1

php5-dom-5.5.14-44.1

php5-dom-debuginfo-5.5.14-44.1

php5-enchant-5.5.14-44.1

php5-enchant-debuginfo-5.5.14-44.1

php5-exif-5.5.14-44.1

php5-exif-debuginfo-5.5.14-44.1

php5-fastcgi-5.5.14-44.1

php5-fastcgi-debuginfo-5.5.14-44.1

php5-fileinfo-5.5.14-44.1

php5-fileinfo-debuginfo-5.5.14-44.1

php5-firebird-5.5.14-44.1

php5-firebird-debuginfo-5.5.14-44.1

php5-fpm-5.5.14-44.1

php5-fpm-debuginfo-5.5.14-44.1

php5-ftp-5.5.14-44.1

php5-ftp-debuginfo-5.5.14-44.1

php5-gd-5.5.14-44.1

php5-gd-debuginfo-5.5.14-44....

Read the Full Advisory

References

https://www.suse.com/security/cve/CVE-2014-9767.html

https://www.suse.com/security/cve/CVE-2015-8835.html

https://www.suse.com/security/cve/CVE-2015-8838.html

https://www.suse.com/security/cve/CVE-2016-2554.html

https://www.suse.com/security/cve/CVE-2016-3141.html

https://www.suse.com/security/cve/CVE-2016-3142.html

https://www.suse.com/security/cve/CVE-2016-3185.html

https://bugzilla.suse.com/968284

https://bugzilla.suse.com/969821

https://bugzilla.suse.com/971611

https://bugzilla.suse.com/971612

https://bugzilla.suse.com/971912

https://bugzilla.suse.com/973351

https://bugzilla.suse.com/973792

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2016:1173-1
Rating: important
Affected Products: openSUSE Leap 42.1 .

Topics%20covered

Topics Covered

security advisory code execution important system stability php5 openSUSE exploit protection

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here