Stay Secure with the Latest Linux Advisories

security advisoryremote code executiondebian

Debian LTS: DLA-1674-1 php5 Security Update Critical RCE Risks

php-pear in php5 contains CWE-502 (Deserialization of Untrusted Data) and CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes) vulnerabilities in its . Package : php5 Version : 5.6.39+dfsg-0+deb8u2 CVE ID : CVE-2018-1000888 php-pear in php5 contains CWE-502 (Deserialization of Untrusted Data) and CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes) vulnerabilities in its Archive_Tar class. When extract is called without a specific prefix path, can trigger unserialization by crafting a tar file with `phar://[path_to_malicious_phar_file]` as path. Object injection can be used to trigger destruct in the loaded PHP classes, all with possible remote code execution that can result in files being deleted or possibly modified. For Debian 8 "Jessie", this problem has been fixed in version 5.6.39+dfsg-0+deb8u2. We recommend that you upgrade your php5 packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Update PHP5 to address security vulnerabilities linked to deserialization and improper modification in Debian systems.. php-pear, CWE-502, CWE-915, security update, remote code execution. . Severity: Critical. LinuxSecurity.com Team

Feb 12, 2019 •Critical Debian LTS