Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

SUSE: 2015:0542-2 Critical: Php7 Security Vulnerability Exploit

suse
Calendar Grey February 24, 2015
Scroller Suse
Crucial SUSE php5 patch addresses multiple vulnerabilities, bolstering overall system security.
An update that fixes four vulnerabilities is now available

Summary

php5 was updated to fix four security issues. These security issues were fixed: - CVE-2015-0231: Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allowed remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8142 (bnc#910659). - CVE-2014-9427: sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, did not properly consider the mapping's length

Topics%20covered

Topics Covered

security advisory security issue code execution remote execution SUSE Linux important severity php5 update

References

#907519 #910659 #911664 #914690

Cross- CVE-2014-8142 CVE-2014-9427 CVE-2015-0231

CVE-2015-0232

Affected Products:

SUSE Linux Enterprise Software Development Kit 12

SUSE Linux Enterprise Module for Web Scripting 12

https://www.suse.com/security/cve/CVE-2014-8142.html

https://www.suse.com/security/cve/CVE-2014-9427.html

https://www.suse.com/security/cve/CVE-2015-0231.html

https://www.suse.com/security/cve/CVE-2015-0232.html

https://bugzilla.suse.com/show_bug.cgi?id=907519

https://bugzilla.suse.com/show_bug.cgi?id=910659

https://bugzilla.suse.com/show_bug.cgi?id=911664

https://bugzilla.suse.com/show_bug.cgi?id=914690

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2015:0365-1
Rating: important

Topics%20covered

Topics Covered

security advisory security issue code execution remote execution SUSE Linux important severity php5 update

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.