Ubuntu: USN-3953-1 Critical: PHP DoS and Remote Code Flaws

ubuntu

April 23, 2019

Several security issues were fixed in PHP.

Summary

Several security issues were fixed in PHP.

Software Description:

- php7.2: HTML-embedded scripting language interpreter

- php7.0: HTML-embedded scripting language interpreter

Details:

It was discovered that PHP incorrectly handled certain exif tags in JPEG

images. A remote attacker could use this issue to cause PHP to crash,

resulting in a denial of service, or possibly execute arbitrary code.

Topics Covered

security advisory remote code execution DoS Ubuntu PHP April 2019

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
  libapache2-mod-php7.2           7.2.17-0ubuntu0.19.04.1
  php7.2-cgi                      7.2.17-0ubuntu0.19.04.1
  php7.2-cli                      7.2.17-0ubuntu0.19.04.1
  php7.2-fpm                      7.2.17-0ubuntu0.19.04.1

Ubuntu 18.10:
  libapache2-mod-php7.2           7.2.17-0ubuntu0.18.10.1
  php7.2-cgi                      7.2.17-0ubuntu0.18.10.1
  php7.2-cli                      7.2.17-0ubuntu0.18.10.1
  php7.2-fpm                      7.2.17-0ubuntu0.18.10.1

Ubuntu 18.04 LTS:
  libapache2-mod-php7.2           7.2.17-0ubuntu0.18.04.1
  php7.2-cgi                      7.2.17-0ubuntu0.18.04.1
  php7.2-cli                      7.2.17-0ubuntu0.18.04.1
  php7.2-fpm                      7.2.17-0ubuntu0.18.04.1

Ubuntu 16.04 LTS:
  libapache2-mod-php7.0           7.0.33-0ubuntu0.16.04.4
  php7.0-cgi                      7.0.33-0ubuntu0.16.04.4
  php7.0-cli                      7.0.33-0ubuntu0.16.04.4
  php7.0-fpm                      7.0.33-0ubuntu0.16.04.4

In Ubuntu 18.04 LTS, Ubuntu 18.10, and Ubuntu 19.04, this update uses a new
upstream release, which includes additional bug fixes.

In general, a standard system update will make all the necessary changes.