Ubuntu 15.04 LTS: USN-2658-1 Critical: PHP Denial of Service & Code Exec

ubuntu

July 6, 2015

Several security issues were fixed in PHP.

Summary

Several security issues were fixed in PHP.

Software Description:

- php5: HTML-embedded scripting language interpreter

Details:

Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL

bytes in file paths. A remote attacker could possibly use this issue to

bypass intended restrictions and create or obtain access to sensitive

files. (CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026,

CVE-2015-4598)

Emmanuel Law discovered that the PHP phar extension incorrectly handled

filenames starting with a NULL byte. A remote attacker could use this issue

with a crafted tar archive to cause a denial of service. (CVE-2015-4021)

Max Spelsberg discovered that PHP incorrectly handled the LIST command

when connecting to remote FTP servers. A malicious FTP server could

possibly use this issue to execute arbitrary code. (CVE-2015-4022,

CVE-2015-4643)

Shusheng Liu discovered that PHP incorrectly handled certain malformed form

data. A remote attacker ...

Read the Full Advisory

Topics Covered

security advisory denial of service critical php ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.04:
  libapache2-mod-php5             5.6.4+dfsg-4ubuntu6.2
  php5-cgi                        5.6.4+dfsg-4ubuntu6.2
  php5-cli                        5.6.4+dfsg-4ubuntu6.2
  php5-fpm                        5.6.4+dfsg-4ubuntu6.2

Ubuntu 14.10:
  libapache2-mod-php5             5.5.12+dfsg-2ubuntu4.6
  php5-cgi                        5.5.12+dfsg-2ubuntu4.6
  php5-cli                        5.5.12+dfsg-2ubuntu4.6
  php5-fpm                        5.5.12+dfsg-2ubuntu4.6

Ubuntu 14.04 LTS:
  libapache2-mod-php5             5.5.9+dfsg-1ubuntu4.11
  php5-cgi                        5.5.9+dfsg-1ubuntu4.11
  php5-cli                        5.5.9+dfsg-1ubuntu4.11
  php5-fpm                        5.5.9+dfsg-1ubuntu4.11

Ubuntu 12.04 LTS:
  libapache2-mod-php5             5.3.10-1ubuntu3.19
  php5-cgi                        5.3.10-1ubuntu3.19
  php5-cli                        5.3.10-1ubuntu3.19
  php5-fpm                        5.3.10-1ubuntu3.19

In general, a standard system update will make all the necessary changes.