Ubuntu 20.04 LTS: USN-4375-1 Critical: PHP DoS Vulnerability

ubuntu

May 27, 2020

PHP could be made to crash if it received a specially crafted file.

Summary

PHP could be made to crash if it received a specially crafted

file.

Software Description:

- php7.4: server-side, HTML-embedded scripting language (metapackage)

- php7.3: server-side, HTML-embedded scripting language (metapackage)

- php7.2: HTML-embedded scripting language interpreter

- php7.0: HTML-embedded scripting language interpreter

- php5: HTML-embedded scripting language interpreter

Details:

It was discovered that PHP incorrectly handled certain files.

An attacker could possibly use this issue to cause a denial of service.

Topics Covered

security advisory software update web application Ubuntu vulnerability Denial of Service PHP

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
  libapache2-mod-php7.4           7.4.3-4ubuntu2.2
  php7.4-cgi                      7.4.3-4ubuntu2.2
  php7.4-cli                      7.4.3-4ubuntu2.2
  php7.4-fpm                      7.4.3-4ubuntu2.2
  php7.4-mbstring                 7.4.3-4ubuntu2.2

Ubuntu 19.10:
  libapache2-mod-php7.3           7.3.11-0ubuntu0.19.10.6
  php7.3-cgi                      7.3.11-0ubuntu0.19.10.6
  php7.3-cli                      7.3.11-0ubuntu0.19.10.6
  php7.3-fpm                      7.3.11-0ubuntu0.19.10.6
  php7.3-mbstring                 7.3.11-0ubuntu0.19.10.6

Ubuntu 18.04 LTS:
  libapache2-mod-php7.2           7.2.24-0ubuntu0.18.04.6
  php7.2-cgi                      7.2.24-0ubuntu0.18.04.6
  php7.2-cli                      7.2.24-0ubuntu0.18.04.6
  php7.2-fpm                      7.2.24-0ubuntu0.18.04.6
  php7.2-mbstring                 7.2.24-0ubuntu0.18.04.6

Ubuntu 16.04 LTS:
  libapache2-mod-php7.0           7.0.33-0ubuntu0.16.04.15
  php7.0-cgi                      7.0.33-0ubuntu0.16.04.15
  php7.0-cli                      7.0.33-0ubuntu0.16.04.15
  php7.0-fpm                      7.0.33-0ubuntu0.16.04.15
  php7.0-mbstring                 7.0.33-0ubuntu0.16.04.15

Ubuntu 14.04 ESM:
  libapache2-mod-php5             5.5.9+dfsg-1ubuntu4.29+esm12
  php5-cgi                        5.5.9+dfsg-1ubuntu4.29+esm12
  php5-cli                        5.5.9+dfsg-1ubuntu4.29+esm12
  php5-fpm                        5.5.9+dfsg-1ubuntu4.29+esm12

Ubuntu 12.04 ESM:
  libapache2-mod-php5             5.3.10-1ubuntu3.47
  php5-cgi                        5.3.10-1ubuntu3.47
  php5-cli                        5.3.10-1ubuntu3.47
  php5-fpm                        5.3.10-1ubuntu3.47

In general, a standard system update will make all the necessary changes.