Stay Secure with the Latest Linux Advisories

security advisoryFedoraphp

Fedora 28: 2019-efa799fd16 Critical: PHP Core Dump and Access Issues

**PHP version 7.2.16** (07 Mar 2019) **Core:** * Fixed bug php#77589 (Core dump using parse_ini_string with numeric sections). (Laruence) * Fixed bug php#77630 (rename() across the device may allow unwanted access during processing). (Stas) **EXIF:** * Fixed bug php#77509 (Uninitialized read in exif_process_IFD_in_TIFF). (Stas) * Fixed bug php#77540 (Invalid Read on. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-efa799fd16 2019-03-15 03:34:44.754261 --------------------------------------------------------------------------------Name : php Product : Fedora 28 Version : 7.2.16 Release : 1.fc28 URL : https://www.php.net/ Summary : PHP scripting language for creating dynamic web sites Description : PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The php package contains the module (often referred to as mod_php) which adds support for the PHP language to Apache HTTP Server. --------------------------------------------------------------------------------Update Information: **PHP version 7.2.16** (07 Mar 2019) **Core:** * Fixed bug php#77589 (Core dump using parse_ini_string with numeric sections). (Laruence) * Fixed bug php#77630 (rename() across the device may allow unwanted access during processing). (Stas) **EXIF:** * Fixed bug php#77509 (Uninitialized read in exif_process_IFD_in_TIFF). (Stas) * Fixed bug php#77540 (Invalid Read on exif_process_SOFn). (Stas) * Fixed bug php#77563 (Uninitialized read in exif_process_IFD_in_MAKERNOTE). (Stas) * Fixed bug php#77659 (Uninitialized read in exif_process_IFD_in_MAKERNOTE). (Stas) **PHAR:** *Fixed bug php#77396 (Null Pointer Dereference in phar_create_or_parse_filename). (bishop) **SPL:** * Fixed bug php#51068 (DirectoryIterator glob:// don't support current path relative queries). (Ahmed Abdou) * Fixed bug php#77431 (openFile() silently truncates after a null byte). (cmb) **Standard:** * Fixed bug php#77552 (Unintialized php_stream_statbuf in stat functions). (John Stevenson) **MySQL** * Disabled LOCAL INFILE by default, can be enabled using php.ini directive mysqli.allow_local_infile for mysqli, or PDO::MYSQL_ATTR_LOCAL_INFILE attribute for pdo_mysql. (Darek Slusarczyk) --------------------------------------------------------------------------------ChangeLog: * Wed Mar 6 2019 Remi Collet - 7.2.16-1 - Update to 7.2.16 - https://www.php.net/releases/7_2_16.php - add upstream patch for OpenSSL 1.1.1b - adapt systzdata patch (v17) * Wed Feb 6 2019 Remi Collet - 7.2.15-1 - Update to 7.2.15 - https://www.php.net/releases/7_2_15.php * Tue Jan 8 2019 Remi Collet - 7.2.14-1 - Update to 7.2.14 - https://www.php.net/releases/7_2_14.php * Sat Dec 8 2018 Remi Collet - 7.2.13-2 - Fix null pointer dereference in imap_mail CVE-2018-19935 * Wed Dec 5 2018 Remi Collet - 7.2.13-1 - Update to 7.2.13 - https://www.php.net/releases/7_2_13.php * Tue Nov 6 2018 Remi Collet - 7.2.12-1 - Update to 7.2.12 - https://www.php.net/releases/7_2_12.php * Wed Oct 10 2018 Remi Collet - 7.2.11-1 - Update to 7.2.11 - https://www.php.net/releases/7_2_11.php * Tue Sep 11 2018 Remi Collet - 7.2.10-1 - Update to 7.2.10 - https://www.php.net/releases/7_2_10.php * Thu Aug 16 2018 Remi Collet - 7.2.9-1 - Update to 7.2.9 - https://www.php.net/releases/7_2_9.php * Tue Jul 17 2018 Remi Collet - 7.2.8-1 - Update to 7.2.8 - https://www.php.net/releases/7_2_8.php - FPM: add getallheaders, backported from 7.3 * Wed Jun 20 2018 Remi Collet - 7.2.7-1 - Update to 7.2.7 - https://www.php.net/releases/7_2_7.php * Wed May 23 2018 Remi Collet - 7.2.6-1 - Update to 7.2.6 -https://www.php.net/releases/7_2_6.php * Tue Apr 24 2018 Remi Collet - 7.2.5-1 - Update to 7.2.5 - https://www.php.net/releases/7_2_5.php * Wed Apr 11 2018 Remi Collet - 7.2.5~RC1-1 - update to 7.2.5RC1 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-efa799fd16' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ . Essential security patches for PHP 7.2.16 tackling various vulnerabilities, such as memory leaks and unauthorized entry.. PHP Security, Fedora Update, Core Dumps, EXIF Issues. . Severity: Critical. LinuxSecurity.com Team

Mar 15, 2019 •Critical Fedora