Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 464
Alerts This Week
Warning Icon 1 464

SUSE: 2016:2683-1 Important: php7 Crash Risk and Code Execution

suse
Calendar Grey October 31, 2016
Scroller Suse
Essential SUSE patch for php7 addresses significant security vulnerabilities, particularly threats of code execution.
An update that fixes three vulnerabilities is now available

Summary

This update for php7 fixes the following security issue: - CVE-2016-7568: A specially crafted image file could cause an application crash or potentially execute arbitrary code when the image is converted to webp (bsc#1001900) - CVE-2016-8670: Stack Buffer Overflow in GD dynamicGetbuf (bsc#1004924) - CVE-2016-6911: Check for out-of-bound read in dynamicGetbuf() (bsc#1005274) Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2016-1576=1 - SUSE Linux Enterprise Module for Web Scripting 12: zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2016-1576=1 To bring your system up-to-date, use "zypper patch".

Topics%20covered

Topics Covered

security advisory code execution patch important SUSE crash risk php7

References

#1001900 #1004924 #1005274

Cross- CVE-2016-6911 CVE-2016-7568 CVE-2016-8670

Affected Products:

SUSE Linux Enterprise Software Development Kit 12-SP1

SUSE Linux Enterprise Module for Web Scripting 12

https://www.suse.com/security/cve/CVE-2016-6911.html

https://www.suse.com/security/cve/CVE-2016-7568.html

https://www.suse.com/security/cve/CVE-2016-8670.html

https://bugzilla.suse.com/1001900

https://bugzilla.suse.com/1004924

https://bugzilla.suse.com/1005274

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2016:2683-1
Rating: important

Topics%20covered

Topics Covered

security advisory code execution patch important SUSE crash risk php7

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.