Ubuntu 14.10 USN-2572-1 Moderate: PHP Denial Of Service Threat

ubuntu

April 20, 2015

Several security issues were fixed in PHP.

Summary

Several security issues were fixed in PHP.

Software Description:

- php5: HTML-embedded scripting language interpreter

Details:

It was discovered that PHP incorrectly handled cleanup when used with

Apache 2.4. A remote attacker could use this issue to cause PHP to crash,

resulting in a denial of service, or possibly execute arbitrary code.

(CVE-2015-3330)

It was discovered that PHP incorrectly handled opening tar, zip or phar

archives through the PHAR extension. A remote attacker could use this issue

to cause PHP to crash, resulting in a denial of service, or possibly

execute arbitrary code. (CVE-2015-3329)

It was discovered that PHP incorrectly handled regular expressions. A

remote attacker could use this issue to cause PHP to crash, resulting in a

denial of service, or possibly execute arbitrary code. (CVE-2015-2305)

Paulos Yibelo discovered that PHP incorrectly handled moving files when a

pathname contained a null character. A remote attacker could us...

Read the Full Advisory

Topics Covered

security advisory denial of service php remote code execution ubuntu php updates

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  libapache2-mod-php5             5.5.12+dfsg-2ubuntu4.4
  php5-cgi                        5.5.12+dfsg-2ubuntu4.4
  php5-cli                        5.5.12+dfsg-2ubuntu4.4
  php5-fpm                        5.5.12+dfsg-2ubuntu4.4

Ubuntu 14.04 LTS:
  libapache2-mod-php5             5.5.9+dfsg-1ubuntu4.9
  php5-cgi                        5.5.9+dfsg-1ubuntu4.9
  php5-cli                        5.5.9+dfsg-1ubuntu4.9
  php5-fpm                        5.5.9+dfsg-1ubuntu4.9

Ubuntu 12.04 LTS:
  libapache2-mod-php5             5.3.10-1ubuntu3.18
  php5-cgi                        5.3.10-1ubuntu3.18
  php5-cli                        5.3.10-1ubuntu3.18
  php5-fpm                        5.3.10-1ubuntu3.18

Ubuntu 10.04 LTS:
  libapache2-mod-php5             5.3.2-1ubuntu4.30
  php5-cgi                        5.3.2-1ubuntu4.30
  php5-cli                        5.3.2-1ubuntu4.30

In general, a standard system update will make all the necessary changes.