Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 550
Alerts This Week
Warning Icon 1 550

SUSE: 2018:1294-1 Important: php53 Remote DoS and XSS Fixes

suse
Calendar Grey May 15, 2018
Scroller Suse
SUSE Security Bulletin for php54 addresses crucial vulnerabilities and concerns. Provides guidance for patch application.
An update that fixes four vulnerabilities is now available

Summary

This update for php53 fixes the following issues: Security issues fixed: - CVE-2018-10545: Fix access controls in FPM child processes (bsc#1091367). - CVE-2018-10547: Fix Reflected XSS on the PHAR 403 and 404 error pages (bsc#1091362). - CVE-2018-10546: Fix an infinite loop exists in ext/iconv/iconv.c (bsc#1091363). - CVE-2018-10548: Fix remote denial of service in ext/ldap/ldap.c (bsc#1091355). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-php53-13599=1 - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-php53-13599=1

Topics%20covered

Topics Covered

security advisory XSS php important access controls remote denial of service infinite loop

References

#1091355 #1091362 #1091363 #1091367

Cross- CVE-2018-10545 CVE-2018-10546 CVE-2018-10547

CVE-2018-10548

Affected Products:

SUSE Linux Enterprise Software Development Kit 11-SP4

SUSE Linux Enterprise Server 11-SP4

SUSE Linux Enterprise Server 11-SP3-LTSS

SUSE Linux Enterprise Point of Sale 11-SP3

SUSE Linux Enterprise Debuginfo 11-SP4

SUSE Linux Enterprise Debuginfo 11-SP3

https://www.suse.com/security/cve/CVE-2018-10545.html

https://www.suse.com/security/cve/CVE-2018-10546.html

https://www.suse.com/security/cve/CVE-2018-10547.html

https://www.suse.com/security/cve/CVE-2018-10548.html

https://bugzilla.suse.com/1091355

https://bugzilla.suse.com/1091362

https://bugzilla.suse.com/1091363

https://bugzilla.suse.com/1091367

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2018:1294-1
Rating: important

Topics%20covered

Topics Covered

security advisory XSS php important access controls remote denial of service infinite loop

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.