Ubuntu 21.04: 5006-1 Moderate: PHP Denial Of Service Threats

ubuntu

July 7, 2021

Several security issues were fixed in PHP.

Summary

Several security issues were fixed in PHP.

Software Description:

- php7.4: HTML-embedded scripting language interpreter

- php7.2: HTML-embedded scripting language interpreter

Details:

It was discovered that PHP incorrectly handled certain PHAR files. A remote

attacker could possibly use this issue to cause PHP to crash, resulting in

a denial of service, or possibly obtain sensitive information. This issue

only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-7068)

It was discovered that PHP incorrectly handled parsing URLs with passwords.

A remote attacker could possibly use this issue to cause PHP to mis-parse

the URL and produce wrong data. This issue only affected Ubuntu 18.04 LTS,

Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2020-7071)

It was discovered that PHP incorrectly handled certain malformed XML data

when being parsed by the SOAP extension. A remote attacker could possibly

use this issue to cause PHP to crash, resulting in a denial of serv...

Read the Full Advisory

Topics Covered

security advisory denial of service php remote access ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.04:
  libapache2-mod-php7.4           7.4.16-1ubuntu2.1
  php7.4-cgi                      7.4.16-1ubuntu2.1
  php7.4-cli                      7.4.16-1ubuntu2.1
  php7.4-fpm                      7.4.16-1ubuntu2.1

Ubuntu 20.10:
  libapache2-mod-php7.4           7.4.9-1ubuntu1.2
  php7.4-cgi                      7.4.9-1ubuntu1.2
  php7.4-cli                      7.4.9-1ubuntu1.2
  php7.4-fpm                      7.4.9-1ubuntu1.2

Ubuntu 20.04 LTS:
  libapache2-mod-php7.4           7.4.3-4ubuntu2.5
  php7.4-cgi                      7.4.3-4ubuntu2.5
  php7.4-cli                      7.4.3-4ubuntu2.5
  php7.4-fpm                      7.4.3-4ubuntu2.5

Ubuntu 18.04 LTS:
  libapache2-mod-php7.2           7.2.24-0ubuntu0.18.04.8
  php7.2-cgi                      7.2.24-0ubuntu0.18.04.8
  php7.2-cli                      7.2.24-0ubuntu0.18.04.8
  php7.2-fpm                      7.2.24-0ubuntu0.18.04.8

In general, a standard system update will make all the necessary changes.