Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 525
Alerts This Week
Warning Icon 1 525

SUSE: 2018:2044-1 Moderate: PHP53 Denial of Service and Use-After-Free

suse
Calendar Grey July 23, 2018
Scroller Suse
SUSE Patch Notification: Resolutions for php53 vulnerabilities addressing denial of service and use-after-free with moderate risk.
An update that fixes two vulnerabilities is now available

Summary

This update for php53 fixes the following issues: The following security issue was fixed: - An out-of-bounds read in the do_core_note function in readelf.c in libmagic.a allowed remote attackers to cause a denial of service via a crafted ELF file (CVE-2018-10360, bsc#1096984) - CVE-2018-12882: exif_read_from_impl allowed attackers to trigger a use-after-free (in exif_read_from_file) because it closed a stream that it is not responsible for closing (bsc#1099098) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11-SP4: zypper in -t patch sdksp4-php53-13700=1 - SUSE Linux Enterprise Server 11-SP4:

Topics%20covered

Topics Covered

security advisory moderate denial of service software update use-after-free php53 suse linux enterprise

References

#1096984 #1099098

Cross- CVE-2018-10360 CVE-2018-12882

Affected Products:

SUSE Linux Enterprise Software Development Kit 11-SP4

SUSE Linux Enterprise Server 11-SP4

SUSE Linux Enterprise Debuginfo 11-SP4

https://www.suse.com/security/cve/CVE-2018-10360.html

https://www.suse.com/security/cve/CVE-2018-12882.html

https://bugzilla.suse.com/1096984

https://bugzilla.suse.com/1099098

Announcement ID: SUSE-SU-2018:2044-1
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate denial of service software update use-after-free php53 suse linux enterprise

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.