Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 542
Alerts This Week
Warning Icon 1 542

Ubuntu 16.04 LTS USN-3095-1 Moderate: PHP Denial of Service Threats

ubuntu
Calendar Grey October 4, 2016
Scroller Ubuntu
A variety of vulnerabilities patched in PHP for Ubuntu highlighted in USN-3096-1. Critical updates required to ensure system safety.
Several security issues were fixed in PHP.

Summary

Several security issues were fixed in PHP.

Software Description:

- php7.0: HTML-embedded scripting language interpreter

- php5: HTML-embedded scripting language interpreter

Details:

Taoguang Chen discovered that PHP incorrectly handled certain invalid

objects when unserializing data. A remote attacker could use this issue to

cause PHP to crash, resulting in a denial of service, or possibly execute

arbitrary code. (CVE-2016-7124)

Taoguang Chen discovered that PHP incorrectly handled invalid session

names. A remote attacker could use this issue to inject arbitrary session

data. (CVE-2016-7125)

It was discovered that PHP incorrectly handled certain gamma values in the

imagegammacorrect function. A remote attacker could use this issue to cause

PHP to crash, resulting in a denial of service, or possibly execute

arbitrary code. (CVE-2016-7127)

It was discovered that PHP incorrectly handled certain crafted TIFF image

thumbnails. A remote attacker could use th...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory moderate denial of service remote attack Ubuntu PHP issue

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  libapache2-mod-php7.0           7.0.8-0ubuntu0.16.04.3
  php7.0-cgi                      7.0.8-0ubuntu0.16.04.3
  php7.0-cli                      7.0.8-0ubuntu0.16.04.3
  php7.0-curl                     7.0.8-0ubuntu0.16.04.3
  php7.0-fpm                      7.0.8-0ubuntu0.16.04.3
  php7.0-gd                       7.0.8-0ubuntu0.16.04.3
  php7.0-mysql                    7.0.8-0ubuntu0.16.04.3

Ubuntu 14.04 LTS:
  libapache2-mod-php5             5.5.9+dfsg-1ubuntu4.20
  php5-cgi                        5.5.9+dfsg-1ubuntu4.20
  php5-cli                        5.5.9+dfsg-1ubuntu4.20
  php5-curl                       5.5.9+dfsg-1ubuntu4.20
  php5-fpm                        5.5.9+dfsg-1ubuntu4.20
  php5-gd                         5.5.9+dfsg-1ubuntu4.20
  php5-mysqlnd                    5.5.9+dfsg-1ubuntu4.20

Ubuntu 12.04 LTS:
  libapache2-mod-php5             5.3.10-1ubuntu3.25
  php5-cgi                        5.3.10-1ubuntu3.25
  php5-cli                        5.3.10-1ubuntu3.25
  php5-curl                       5.3.10-1ubuntu3.25
  php5-fpm                        5.3.10-1ubuntu3.25
  php5-gd                         5.3.10-1ubuntu3.25
  php5-mysqlnd                    5.3.10-1ubuntu3.25

In general, a standard system update will make all the necessary changes.

References

CVE-2016-7124, CVE-2016-7125, CVE-2016-7127, CVE-2016-7128,

CVE-2016-7129, CVE-2016-7130, CVE-2016-7131, CVE-2016-7132,

CVE-2016-7133, CVE-2016-7134, CVE-2016-7411, CVE-2016-7412,

CVE-2016-7413, CVE-2016-7414, CVE-2016-7416, CVE-2016-7417,

CVE-2016-7418

Severity
important
Lowest
Low
Medium
High
Critical

October 04, 2016

Topics%20covered

Topics Covered

security advisory moderate denial of service remote attack Ubuntu PHP issue

Package Information

https://launchpad.net/ubuntu/+source/php7.0/7.0.8-0ubuntu0.16.04.3
https://launchpad.net/ubuntu/+source/php5/5.5.9+dfsg-1ubuntu4.20
https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.25

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.