Ubuntu 14.10 USN-2535-1 Addresses Critical PHP Denial of Service Issue

ubuntu

March 18, 2015

Several security issues were fixed in PHP.

Summary

Several security issues were fixed in PHP.

Software Description:

- php5: HTML-embedded scripting language interpreter

Details:

Thomas Jarosch discovered that PHP incorrectly limited recursion in the

fileinfo extension. A remote attacker could possibly use this issue to

cause PHP to consume resources or crash, resulting in a denial of service.

(CVE-2014-8117)

S. Paraschoudis discovered that PHP incorrectly handled memory in the

enchant binding. A remote attacker could use this issue to cause PHP to

crash, resulting in a denial of service, or possibly execute arbitrary

code. (CVE-2014-9705)

Taoguang Chen discovered that PHP incorrectly handled unserializing

objects. A remote attacker could use this issue to cause PHP to crash,

resulting in a denial of service, or possibly execute arbitrary code.

(CVE-2015-0273)

It was discovered that PHP incorrectly handled memory in the phar

extension. A remote attacker could use this issue to cause PHP to crash,

resul...

Read the Full Advisory

Topics Covered

security advisory denial of service Ubuntu memory issue PHP

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  libapache2-mod-php5             5.5.12+dfsg-2ubuntu4.3
  php5-cgi                        5.5.12+dfsg-2ubuntu4.3
  php5-cli                        5.5.12+dfsg-2ubuntu4.3
  php5-enchant                    5.5.12+dfsg-2ubuntu4.3
  php5-fpm                        5.5.12+dfsg-2ubuntu4.3

Ubuntu 14.04 LTS:
  libapache2-mod-php5             5.5.9+dfsg-1ubuntu4.7
  php5-cgi                        5.5.9+dfsg-1ubuntu4.7
  php5-cli                        5.5.9+dfsg-1ubuntu4.7
  php5-enchant                    5.5.9+dfsg-1ubuntu4.7
  php5-fpm                        5.5.9+dfsg-1ubuntu4.7

Ubuntu 12.04 LTS:
  libapache2-mod-php5             5.3.10-1ubuntu3.17
  php5-cgi                        5.3.10-1ubuntu3.17
  php5-cli                        5.3.10-1ubuntu3.17
  php5-enchant                    5.3.10-1ubuntu3.17
  php5-fpm                        5.3.10-1ubuntu3.17

Ubuntu 10.04 LTS:
  libapache2-mod-php5             5.3.2-1ubuntu4.29
  php5-cgi                        5.3.2-1ubuntu4.29
  php5-cli                        5.3.2-1ubuntu4.29
  php5-enchant                    5.3.2-1ubuntu4.29

In general, a standard system update will make all the necessary changes.