Ubuntu 1761-1: PHP Exposure Risk – Remote Threat Advisory

ubuntu

March 13, 2013

PHP could be made to expose sensitive information over the network.

Summary

PHP could be made to expose sensitive information over the network.

Software Description:

- php5: HTML-embedded scripting language interpreter

Details:

It was discovered that PHP incorrectly handled XML external entities in

SOAP WSDL files. A remote attacker could use this flaw to read arbitrary

files off the server.

Topics Covered

security advisory php remote threat information exposure ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
  php5                            5.4.6-1ubuntu1.2

Ubuntu 12.04 LTS:
  php5                            5.3.10-1ubuntu3.6

Ubuntu 11.10:
  php5                            5.3.6-13ubuntu3.10

Ubuntu 10.04 LTS:
  php5                            5.3.2-1ubuntu4.19

Ubuntu 8.04 LTS:
  php5                            5.2.4-2ubuntu5.27

In general, a standard system update will make all the necessary changes.