Alerts This Week
Warning Icon 1 535
Alerts This Week
Warning Icon 1 535

Ubuntu 18.04 LTS: USN-6841-2 Critical PHP Invalid URL Issue

Calendar Sep 09, 2024 • User Avatar LinuxSecurity Advisories
1 - 2 min read
Ubuntu Large Esm H500
Topics%20covered

Topics Covered

security advisory DoS Ubuntu application fix php7.0 php7.2 invalid URLs
PHP could be made to accept invalid URLs. 
==========================================================================
Ubuntu Security Notice USN-6841-2
September 09, 2024

php7.0, php7.2 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

PHP could be made to accept invalid URLs.

Software Description:
- php7.2: HTML-embedded scripting language interpreter
- php7.0: HTML-embedded scripting language interpreter

Details:

USN-6841-1 fixed a vulnerability in PHP. This update provides the
corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

  It was discovered that PHP could early return in the filter_var function
  resulting in invalid user information being treated as valid user
  information. An attacker could possibly use this issue to expose raw
  user input information.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS
   libapache2-mod-php7.2           7.2.24-0ubuntu0.18.04.17+esm5
                                   Available with Ubuntu Pro
   php7.2                          7.2.24-0ubuntu0.18.04.17+esm5
                                   Available with Ubuntu Pro
   php7.2-cgi                      7.2.24-0ubuntu0.18.04.17+esm5
                                   Available with Ubuntu Pro
   php7.2-cli                      7.2.24-0ubuntu0.18.04.17+esm5
                                   Available with Ubuntu Pro
   php7.2-fpm                      7.2.24-0ubuntu0.18.04.17+esm5
                                   Available with Ubuntu Pro

Ubuntu 16.04 LTS
   libapache2-mod-php7.0           7.0.33-0ubuntu0.16.04.16+esm11
                                   Available with Ubuntu Pro
   php7.0                          7.0.33-0ubuntu0.16.04.16+esm11
                                   Available with Ubuntu Pro
   php7.0-cgi                      7.0.33-0ubuntu0.16.04.16+esm11
                                   Available with Ubuntu Pro
   php7.0-cli                      7.0.33-0ubuntu0.16.04.16+esm11
                                   Available with Ubuntu Pro
   php7.0-fpm                      7.0.33-0ubuntu0.16.04.16+esm11
                                   Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-6841-2
   https://ubuntu.com/security/notices/USN-6841-1
   CVE-2024-5458

Ubuntu 18.04 LTS: USN-6841-2 Critical PHP Invalid URL Issue

ubuntu
Calendar Grey September 9, 2024
Dist Ubuntu Esm H88
Fortify your system by implementing Ubuntu patches that resolve PHP handling of malformed URLs in releases 7.0 and 7.2.
PHP could be made to accept invalid URLs.

Summary

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: PHP could be made to accept invalid URLs. Software Description: - php7.2: HTML-embedded scripting language interpreter - php7.0: HTML-embedded scripting language interpreter Details: USN-6841-1 fixed a vulnerability in PHP. This update provides the corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details:  It was discovered that PHP could early return in the filter_var function  resulting in invalid user information being treated as valid user  information. An attacker could possibly use this issue to expose raw  user input information.

Topics%20covered

Topics Covered

security advisory DoS Ubuntu application fix php7.0 php7.2 invalid URLs

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS   libapache2-mod-php7.2           7.2.24-0ubuntu0.18.04.17+esm5                                   Available with Ubuntu Pro   php7.2                          7.2.24-0ubuntu0.18.04.17+esm5                                   Available with Ubuntu Pro   php7.2-cgi                      7.2.24-0ubuntu0.18.04.17+esm5                                   Available with Ubuntu Pro   php7.2-cli                      7.2.24-0ubuntu0.18.04.17+esm5                                   Available with Ubuntu Pro   php7.2-fpm                      7.2.24-0ubuntu0.18.04.17+esm5                                   Available with Ubuntu Pro Ubuntu 16.04 LTS   libapache2-mod-php7.0           7.0.33-0ubuntu0.16.04.16+esm11                                   Available with Ubuntu Pro   php7.0                          7.0.33-0ubuntu0.16.04.16+esm11                                   Available with Ubuntu Pro   php7.0-cgi                      7.0.33-0ubuntu0.16.04.16+esm11                                   Available with Ubuntu Pro   php7.0-cli                      7.0.33-0ubuntu0.16.04.16+esm11                                   Available with Ubuntu Pro   php7.0-fpm                      7.0.33-0ubuntu0.16.04.16+esm11                                   Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

References

  https://ubuntu.com/security/notices/USN-6841-2

  https://ubuntu.com/security/notices/USN-6841-1

  CVE-2024-5458

Severity
critical
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-6841-2

Topics%20covered

Topics Covered

security advisory DoS Ubuntu application fix php7.0 php7.2 invalid URLs

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here