Alerts This Week
Warning Icon 1 666
Alerts This Week
Warning Icon 1 666

openSUSE 13.2: 2016:1761-1 Important: php5 Heap Overflow

opensuse
Calendar Grey July 7, 2016
Dist Opensuse Esm H88
Important revision for openSUSE, tackling 9 vulnerabilities in php5 and guaranteeing system safety.
An update that fixes 9 vulnerabilities is now available

Description

php5 was updated to fix nine security issues.

These security issues were fixed:

- CVE-2016-5773: ZipArchive class Use After Free Vulnerability in PHP's GC

algorithm and unserialize (bsc#986247).

- CVE-2016-5772: Double Free Courruption in wddx_deserialize (bsc#986244).

- CVE-2016-5771: Use After Free Vulnerability in PHP's GC algorithm and

unserialize (bsc#986391).

- CVE-2016-5770: int/size_t confusion in SplFileObject::fread (bsc#986392).

- CVE-2016-5768: Double free in _php_mb_regex_ereg_replace_exec -

(bsc#986246).

- CVE-2016-5769: mcrypt: Heap Overflow due to integer overflows

(bsc#986388).

- CVE-2015-8935: XSS in header() with Internet Explorer (bsc#986004).

- CVE-2016-5767: Integer Overflow in gdImagePaletteToTrueColor() resulting

in heap overflow (bsc#986393).

- CVE-2016-5766: Integer Overflow in _gd2GetHeader() resulting in heap

overflow (bsc#986386).

Topics%20covered

Topics Covered

security advisory update important heap overflow integer overflow php5 openSUSE

Patch

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

- openSUSE 13.2:

zypper in -t patch openSUSE-2016-844=1

To bring your system up-to-date, use "zypper patch".

Package List

- openSUSE 13.2 (i586 x86_64):

apache2-mod_php5-5.6.1-69.1

apache2-mod_php5-debuginfo-5.6.1-69.1

php5-5.6.1-69.1

php5-bcmath-5.6.1-69.1

php5-bcmath-debuginfo-5.6.1-69.1

php5-bz2-5.6.1-69.1

php5-bz2-debuginfo-5.6.1-69.1

php5-calendar-5.6.1-69.1

php5-calendar-debuginfo-5.6.1-69.1

php5-ctype-5.6.1-69.1

php5-ctype-debuginfo-5.6.1-69.1

php5-curl-5.6.1-69.1

php5-curl-debuginfo-5.6.1-69.1

php5-dba-5.6.1-69.1

php5-dba-debuginfo-5.6.1-69.1

php5-debuginfo-5.6.1-69.1

php5-debugsource-5.6.1-69.1

php5-devel-5.6.1-69.1

php5-dom-5.6.1-69.1

php5-dom-debuginfo-5.6.1-69.1

php5-enchant-5.6.1-69.1

php5-enchant-debuginfo-5.6.1-69.1

php5-exif-5.6.1-69.1

php5-exif-debuginfo-5.6.1-69.1

php5-fastcgi-5.6.1-69.1

php5-fastcgi-debuginfo-5.6.1-69.1

php5-fileinfo-5.6.1-69.1

php5-fileinfo-debuginfo-5.6.1-69.1

php5-firebird-5.6.1-69.1

php5-firebird-debuginfo-5.6.1-69.1

php5-fpm-5.6.1-69.1

php5-fpm-debuginfo-5.6.1-69.1

php5-ftp-5.6.1-69.1

php5-ftp-debuginfo-5.6.1-69.1

php5-gd-5.6.1-69.1

php5-gd-debuginfo-5.6.1-69.1

php5-gettext-5.6.1-69.1

php5-gettext-debu...

Read the Full Advisory

References

https://www.suse.com/security/cve/CVE-2015-8935.html

https://www.suse.com/security/cve/CVE-2016-5766.html

https://www.suse.com/security/cve/CVE-2016-5767.html

https://www.suse.com/security/cve/CVE-2016-5768.html

https://www.suse.com/security/cve/CVE-2016-5769.html

https://www.suse.com/security/cve/CVE-2016-5770.html

https://www.suse.com/security/cve/CVE-2016-5771.html

https://www.suse.com/security/cve/CVE-2016-5772.html

https://www.suse.com/security/cve/CVE-2016-5773.html

https://bugzilla.suse.com/986004

https://bugzilla.suse.com/986244

https://bugzilla.suse.com/986246

https://bugzilla.suse.com/986247

https://bugzilla.suse.com/986386

https://bugzilla.suse.com/986388

https://bugzilla.suse.com/986391

https://bugzilla.suse.com/986392

https://bugzilla.suse.com/986393

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2016:1761-1
Rating: important
Affected Products: openSUSE 13.2 .

Topics%20covered

Topics Covered

security advisory update important heap overflow integer overflow php5 openSUSE

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here