Ubuntu 14.04 LTS USN-2276-1 Critical: PHP Code Execution and DoS Risk

ubuntu

July 9, 2014

Several security issues were fixed in PHP.

Summary

Several security issues were fixed in PHP.

Software Description:

- php5: HTML-embedded scripting language interpreter

Details:

Francisco Alonso discovered that the PHP Fileinfo component incorrectly

handled certain CDF documents. A remote attacker could use this issue to

cause PHP to hang or crash, resulting in a denial of service.

(CVE-2014-0207, CVE-2014-3478, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487)

Stefan Esser discovered that PHP incorrectly handled unserializing SPL

extension objects. An attacker could use this issue to execute arbitrary

code. (CVE-2014-3515)

It was discovered that PHP incorrectly handled certain SPL Iterators. An

attacker could use this issue to cause PHP to crash, resulting in a denial

of service. (CVE-2014-4670)

It was discovered that PHP incorrectly handled certain ArrayIterators. An

attacker could use this issue to cause PHP to crash, resulting in a denial

of service. (CVE-2014-4698)

Stefan Esser discovered that PHP in...

Read the Full Advisory

Topics Covered

security advisory denial of service remote code execution PHP issue Ubuntu 14.04 LTS

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  libapache2-mod-php5             5.5.9+dfsg-1ubuntu4.3
  php5-cgi                        5.5.9+dfsg-1ubuntu4.3
  php5-cli                        5.5.9+dfsg-1ubuntu4.3
  php5-fpm                        5.5.9+dfsg-1ubuntu4.3

Ubuntu 13.10:
  libapache2-mod-php5             5.5.3+dfsg-1ubuntu2.6
  php5-cgi                        5.5.3+dfsg-1ubuntu2.6
  php5-cli                        5.5.3+dfsg-1ubuntu2.6
  php5-fpm                        5.5.3+dfsg-1ubuntu2.6

Ubuntu 12.04 LTS:
  libapache2-mod-php5             5.3.10-1ubuntu3.13
  php5-cgi                        5.3.10-1ubuntu3.13
  php5-cli                        5.3.10-1ubuntu3.13
  php5-fpm                        5.3.10-1ubuntu3.13

Ubuntu 10.04 LTS:
  libapache2-mod-php5             5.3.2-1ubuntu4.26
  php5-cgi                        5.3.2-1ubuntu4.26
  php5-cli                        5.3.2-1ubuntu4.26

In general, a standard system update will make all the necessary changes.