Ubuntu: 4166-1 Urgent: PHP Vulnerability Allows Remote Code Execution

ubuntu

October 28, 2019

PHP could be made to run programs if it received specially crafted network traffic.

Summary

PHP could be made to run programs if it received specially crafted network

traffic.

Software Description:

- php7.3: HTML-embedded scripting language interpreter

- php7.2: HTML-embedded scripting language interpreter

- php7.0: HTML-embedded scripting language interpreter

Details:

It was discovered that PHP incorrectly handled certain paths when being

used in FastCGI configurations. A remote attacker could possibly use this

issue to execute arbitrary code.

Topics Covered

security advisory software update php remote code execution arbitrary code execution network traffic ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.10:
  libapache2-mod-php7.3           7.3.11-0ubuntu0.19.10.1
  php7.3-cgi                      7.3.11-0ubuntu0.19.10.1
  php7.3-cli                      7.3.11-0ubuntu0.19.10.1
  php7.3-fpm                      7.3.11-0ubuntu0.19.10.1

Ubuntu 19.04:
  libapache2-mod-php7.2           7.2.24-0ubuntu0.19.04.1
  php7.2-cgi                      7.2.24-0ubuntu0.19.04.1
  php7.2-cli                      7.2.24-0ubuntu0.19.04.1
  php7.2-fpm                      7.2.24-0ubuntu0.19.04.1

Ubuntu 18.04 LTS:
  libapache2-mod-php7.2           7.2.24-0ubuntu0.18.04.1
  php7.2-cgi                      7.2.24-0ubuntu0.18.04.1
  php7.2-cli                      7.2.24-0ubuntu0.18.04.1
  php7.2-fpm                      7.2.24-0ubuntu0.18.04.1

Ubuntu 16.04 LTS:
  libapache2-mod-php7.0           7.0.33-0ubuntu0.16.04.7
  php7.0-cgi                      7.0.33-0ubuntu0.16.04.7
  php7.0-cli                      7.0.33-0ubuntu0.16.04.7
  php7.0-fpm                      7.0.33-0ubuntu0.16.04.7

In general, a standard system update will make all the necessary changes.