Scientific Linux 7 x86_64: SLSA-2016:1613-1 Moderate: PHP Security Fix

Date: Tue, 16 Aug 2016 20:55:17 -0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Kevin Hill 
Subject: Security ERRATA Moderate: php on SL7.x x86_64
MIME-Version: 1.0
Message-ID: <20160816205517.14867.89897@slpackages.fnal.gov>

Synopsis: Moderate: php security and bug fix update
Advisory ID: SLSA-2016:1613-1
Issue Date: 2016-08-11
CVE Numbers: CVE-2016-5385
--

Security Fix(es):

* It was discovered that PHP did not properly protect against the
HTTP_PROXY variable name clash. A remote attacker could possibly use this
flaw to redirect HTTP requests performed by a PHP script to an attacker-
controlled proxy via a malicious HTTP request. (CVE-2016-5385)

Bug Fix(es):

* Previously, an incorrect logic in the SAPI header callback routine
caused that the callback counter was not incremented. Consequently, when a
script included a header callback, it could terminate unexpectedly with a
segmentation fault. With this update, the callback counter is properly
managed, and scripts with a header callback implementation work as
expected.
--

SL7
 x86_64
 php-5.4.16-36.3.el7_2.x86_64.rpm
 php-bcmath-5.4.16-36.3.el7_2.x86_64.rpm
 php-cli-5.4.16-36.3.el7_2.x86_64.rpm
 php-common-5.4.16-36.3.el7_2.x86_64.rpm
 php-dba-5.4.16-36.3.el7_2.x86_64.rpm
 php-debuginfo-5.4.16-36.3.el7_2.x86_64.rpm
 php-devel-5.4.16-36.3.el7_2.x86_64.rpm
 php-embedded-5.4.16-36.3.el7_2.x86_64.rpm
 php-enchant-5.4.16-36.3.el7_2.x86_64.rpm
 php-fpm-5.4.16-36.3.el7_2.x86_64.rpm
 php-gd-5.4.16-36.3.el7_2.x86_64.rpm
 php-intl-5.4.16-36.3.el7_2.x86_64.rpm
 php-ldap-5.4.16-36.3.el7_2.x86_64.rpm
 php-mbstring-5.4.16-36.3.el7_2.x86_64.rpm
 php-mysql-5.4.16-36.3.el7_2.x86_64.rpm
 php-mysqlnd-5.4.16-36.3.el7_2.x86_64.rpm
 php-odbc-5.4.16-36.3.el7_2.x86_64.rpm
 php-pdo-5.4.16-36.3.el7_2.x86_64.rpm
 php-pgsql-5.4.16-36.3.el7_2.x86_64.rpm
 php-process-5.4.16-36.3.el7_2.x86_64.rpm
 php-pspell-5.4.16-36.3.el7_2.x86_64.rpm
 php-recode-5.4.16-36.3.el7_2.x86_64.rpm
 php-snmp-5.4.16-36.3.el7_2.x86_64.rpm
 php-soap-5.4.16-36.3.el7_2.x86_64.rpm
 php-xml-5.4.16-36.3.el7_2.x86_64.rpm
 php-xmlrpc-5.4.16-36.3.el7_2.x86_64.rpm

- Scientific Linux Development Team