Debian Security Advisory
DLA-1397-1 php5 -- LTS security update
- Date Reported:
- 26 Jun 2018
- Affected Packages:
- Security database references:
- In Mitre's CVE dictionary: CVE-2018-7584, CVE-2018-10545, CVE-2018-10546, CVE-2018-10547, CVE-2018-10548, CVE-2018-10549.
- More information:
Several vulnerabilities were found in PHP, a widely-used open source general purpose scripting language:
A stack-buffer-overflow while parsing HTTP response results in copying a large string and possible memory corruption and/or denial of service
Dumpable FPM child processes allow bypassing opcache access controls resulting in potential information disclosure where one user can obtain information about another user's running PHP applications
An invalid sequence of bytes can trigger an infinite loop in the stream filter convert.iconv
A previous fix for CVE-2018-5712 may not be complete, resulting in an additional vulnerability in the form of a reflected XSS in the PHAR 403 and 404 error pages
A malicious remote LDAP server can send a crafted response that will cause a denial of service (NULL pointer dereference resulting in an application crash)
A crafted JPEG file can case an out-of-bounds read and heap buffer overflow
For Debian 8
Jessie, these problems have been fixed in version 5.6.36+dfsg-0+deb8u1.
We recommend that you upgrade your php5 packages.
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS