Alerts This Week
Warning Icon 1 535
Alerts This Week
Warning Icon 1 535

openSUSE Leap 42.3: openSUSE-SU-2017:2337-1 Critical: PHP7 DoS Issue

opensuse
Calendar Grey September 4, 2017
Dist Opensuse Esm H88
A significant patch for php7 addresses various security flaws, boosting system stability and efficiency for users of openSUSE.
An update that solves 9 vulnerabilities and has two fixes An update that solves 9 vulnerabilities and has two fixes An update that solves 9 vulnerabilities and has two fixes is now...

Description

This update for php7 fixes the following issues:

- CVE-2016-10397: parse_url() can be bypassed to return fake host.

(bsc#1047454)

- CVE-2017-11142: Remoteattackers could cause a CPU consumption denial of

service attack by injectinglong form variables, related to

main/php_variables. (bsc#1048100)

- CVE-2017-11144: The opensslextension PEM sealing code did not check the

return value of the OpenSSL sealingfunction, which could lead to a

crash. (bsc#1048096)

- CVE-2017-11145: Lack of bounds checks in timelib_meridian coud lead to

information leak. (bsc#1048112)

- CVE-2017-11146: Lack of bounds checks in timelib_meridian parse code

could lead to information leak. (bsc#1048111)

- CVE-2017-11147: The PHAR archive handler could beused by attackers supplying malicious archive files to crash the PHP interpreteror

potentially disclose information. (bsc#1048094)

- CVE-2017-11628: Stack-base dbuffer overflow in zend_ini_do_op()...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service information leak patch important openSUSE php7

Patch

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2017-994=1

- openSUSE Leap 42.2:

zypper in -t patch openSUSE-2017-994=1

To bring your system up-to-date, use "zypper patch".

Package List

- openSUSE Leap 42.3 (i586 x86_64):

apache2-mod_php7-7.0.7-19.1

apache2-mod_php7-debuginfo-7.0.7-19.1

php7-7.0.7-19.1

php7-bcmath-7.0.7-19.1

php7-bcmath-debuginfo-7.0.7-19.1

php7-bz2-7.0.7-19.1

php7-bz2-debuginfo-7.0.7-19.1

php7-calendar-7.0.7-19.1

php7-calendar-debuginfo-7.0.7-19.1

php7-ctype-7.0.7-19.1

php7-ctype-debuginfo-7.0.7-19.1

php7-curl-7.0.7-19.1

php7-curl-debuginfo-7.0.7-19.1

php7-dba-7.0.7-19.1

php7-dba-debuginfo-7.0.7-19.1

php7-debuginfo-7.0.7-19.1

php7-debugsource-7.0.7-19.1

php7-devel-7.0.7-19.1

php7-dom-7.0.7-19.1

php7-dom-debuginfo-7.0.7-19.1

php7-enchant-7.0.7-19.1

php7-enchant-debuginfo-7.0.7-19.1

php7-exif-7.0.7-19.1

php7-exif-debuginfo-7.0.7-19.1

php7-fastcgi-7.0.7-19.1

php7-fastcgi-debuginfo-7.0.7-19.1

php7-fileinfo-7.0.7-19.1

php7-fileinfo-debuginfo-7.0.7-19.1

php7-firebird-7.0.7-19.1

php7-firebird-debuginfo-7.0.7-19.1

php7-fpm-7.0.7-19.1

php7-fpm-debuginfo-7.0.7-19.1

php7-ftp-7.0.7-19.1

php7-ftp-debuginfo-7.0.7-19.1

php7-gd-7.0.7-19.1

php7-gd-debuginfo-7.0.7-19.1

php7-gettext-7.0.7-19.1

php7-gettext...

Read the Full Advisory

References

https://www.suse.com/security/cve/CVE-2016-10397.html

https://www.suse.com/security/cve/CVE-2016-5766.html

https://www.suse.com/security/cve/CVE-2017-11142.html

https://www.suse.com/security/cve/CVE-2017-11144.html

https://www.suse.com/security/cve/CVE-2017-11145.html

https://www.suse.com/security/cve/CVE-2017-11146.html

https://www.suse.com/security/cve/CVE-2017-11147.html

https://www.suse.com/security/cve/CVE-2017-11628.html

https://www.suse.com/security/cve/CVE-2017-7890.html

https://bugzilla.suse.com/1047454

https://bugzilla.suse.com/1048094

https://bugzilla.suse.com/1048096

https://bugzilla.suse.com/1048100

https://bugzilla.suse.com/1048111

https://bugzilla.suse.com/1048112

https://bugzilla.suse.com/1050241

https://bugzilla.suse.com/1050726

https://bugzilla.suse.com/1052389

https://bugzilla.suse.com/1053645

https://bugzilla.suse.com/986386

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2017:2337-1
Rating: important
Affected Products: openSUSE Leap 42.3 openSUSE Leap 42.2

Topics%20covered

Topics Covered

security advisory denial of service information leak patch important openSUSE php7

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here