Alerts This Week
Warning Icon 1 700
Alerts This Week
Warning Icon 1 700

Ubuntu 18.04, 16.04: USN-7049-2 critical: PHP remote access issue

Calendar Nov 14, 2024 • User Avatar LinuxSecurity Advisories
1 - 2 min read
Ubuntu Large Esm H500
Topics%20covered

Topics Covered

security advisory critical software update php remote access ubuntu
Several security issues were fixed in PHP. 
==========================================================================
Ubuntu Security Notice USN-7049-2
November 14, 2024

php7.0, php7.2 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in PHP.

Software Description:
- php7.2: HTML-embedded scripting language interpreter
- php7.0: HTML-embedded scripting language interpreter

Details:

USN-7049-1 fixed vulnerabilities in PHP. This update provides the
corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

  It was discovered that PHP incorrectly handled parsing multipart form
  data. A remote attacker could possibly use this issue to inject payloads
  and cause PHP to ignore legitimate data. (CVE-2024-8925)

  It was discovered that PHP incorrectly handled the cgi.force_redirect
  configuration option due to environment variable collisions. In certain
  configurations, an attacker could possibly use this issue bypass
  force_redirect restrictions. (CVE-2024-8927)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS
   libapache2-mod-php7.2           7.2.24-0ubuntu0.18.04.17+esm6
                                   Available with Ubuntu Pro
   php7.2-cgi                      7.2.24-0ubuntu0.18.04.17+esm6
                                   Available with Ubuntu Pro
   php7.2-cli                      7.2.24-0ubuntu0.18.04.17+esm6
                                   Available with Ubuntu Pro
   php7.2-fpm                      7.2.24-0ubuntu0.18.04.17+esm6
                                   Available with Ubuntu Pro

Ubuntu 16.04 LTS
   libapache2-mod-php7.0           7.0.33-0ubuntu0.16.04.16+esm12
                                   Available with Ubuntu Pro
   php7.0-cgi                      7.0.33-0ubuntu0.16.04.16+esm12
                                   Available with Ubuntu Pro
   php7.0-cli                      7.0.33-0ubuntu0.16.04.16+esm12
                                   Available with Ubuntu Pro
   php7.0-fpm                      7.0.33-0ubuntu0.16.04.16+esm12
                                   Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-7049-2
   https://ubuntu.com/security/notices/USN-7049-1
   CVE-2024-8925, CVE-2024-8927

Ubuntu 18.04, 16.04: USN-7049-2 critical: PHP remote access issue

ubuntu
Calendar Grey November 14, 2024
Dist Ubuntu Esm H88
The latest security bulletin from Ubuntu addresses severe remote access weaknesses and provides essential patches for safeguarding your systems.
Several security issues were fixed in PHP.

Summary

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in PHP. Software Description: - php7.2: HTML-embedded scripting language interpreter - php7.0: HTML-embedded scripting language interpreter Details: USN-7049-1 fixed vulnerabilities in PHP. This update provides the corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details:  It was discovered that PHP incorrectly handled parsing multipart form  data. A remote attacker could possibly use this issue to inject payloads  and cause PHP to ignore legitimate data. (CVE-2024-8925)  It was discovered that PHP incorrectly handled the cgi.force_redirect  configuration option due to environment variable collisions. In certain  configurations, an attacker could possibly use this issue bypass  force_redirect restrictions. (CVE-2024-8927)

Topics%20covered

Topics Covered

security advisory critical software update php remote access ubuntu

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS   libapache2-mod-php7.2           7.2.24-0ubuntu0.18.04.17+esm6                                   Available with Ubuntu Pro   php7.2-cgi                      7.2.24-0ubuntu0.18.04.17+esm6                                   Available with Ubuntu Pro   php7.2-cli                      7.2.24-0ubuntu0.18.04.17+esm6                                   Available with Ubuntu Pro   php7.2-fpm                      7.2.24-0ubuntu0.18.04.17+esm6                                   Available with Ubuntu Pro Ubuntu 16.04 LTS   libapache2-mod-php7.0           7.0.33-0ubuntu0.16.04.16+esm12                                   Available with Ubuntu Pro   php7.0-cgi                      7.0.33-0ubuntu0.16.04.16+esm12                                   Available with Ubuntu Pro   php7.0-cli                      7.0.33-0ubuntu0.16.04.16+esm12                                   Available with Ubuntu Pro   php7.0-fpm                      7.0.33-0ubuntu0.16.04.16+esm12                                   Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

References

  https://ubuntu.com/security/notices/USN-7049-2

  https://ubuntu.com/security/notices/USN-7049-1

  CVE-2024-8925, CVE-2024-8927

Severity
critical
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-7049-2

Topics%20covered

Topics Covered

security advisory critical software update php remote access ubuntu

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here