Ubuntu 14.10 USN-2501-1 Moderate PHP Code Execution Risks

ubuntu

February 17, 2015

Several security issues were fixed in PHP.

Summary

Several security issues were fixed in PHP.

Software Description:

- php5: HTML-embedded scripting language interpreter

Details:

Stefan Esser discovered that PHP incorrectly handled unserializing objects.

A remote attacker could use this issue to cause PHP to crash, resulting in

a denial of service, or possibly execute arbitrary code. (CVE-2014-8142,

CVE-2015-0231)

Brian Carpenter discovered that the PHP CGI component incorrectly handled

invalid files. A local attacker could use this issue to obtain sensitive

information, or possibly execute arbitrary code. This issue only affected

Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2014-9427)

It was discovered that PHP incorrectly handled certain pascal strings in

the fileinfo extension. A remote attacker could possibly use this issue to

cause PHP to crash, resulting in a denial of service. This issue only

affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2014-9652)

Alex Eubanks discovered that PHP incorrectly handle...

Read the Full Advisory

Topics Covered

security advisory moderate denial of service software update code execution php ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  libapache2-mod-php5             5.5.12+dfsg-2ubuntu4.2
  php5-cgi                        5.5.12+dfsg-2ubuntu4.2
  php5-cli                        5.5.12+dfsg-2ubuntu4.2
  php5-fpm                        5.5.12+dfsg-2ubuntu4.2
  php5-pgsql                      5.5.12+dfsg-2ubuntu4.2

Ubuntu 14.04 LTS:
  libapache2-mod-php5             5.5.9+dfsg-1ubuntu4.6
  php5-cgi                        5.5.9+dfsg-1ubuntu4.6
  php5-cli                        5.5.9+dfsg-1ubuntu4.6
  php5-fpm                        5.5.9+dfsg-1ubuntu4.6
  php5-pgsql                      5.5.9+dfsg-1ubuntu4.6

Ubuntu 12.04 LTS:
  libapache2-mod-php5             5.3.10-1ubuntu3.16
  php5-cgi                        5.3.10-1ubuntu3.16
  php5-cli                        5.3.10-1ubuntu3.16
  php5-fpm                        5.3.10-1ubuntu3.16
  php5-pgsql                      5.3.10-1ubuntu3.16

In general, a standard system update will make all the necessary changes.