[SECURITY] [DLA 2708-1] php7.0 security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2708-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Sylvain Beucler
July 15, 2021 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : php7.0
Version : 7.0.33-0+deb9u11
CVE ID : CVE-2019-18218 CVE-2020-7071 CVE-2021-21702 CVE-2021-21704
CVE-2021-21705
Debian Bug : 942830 990575
Several vulnerabilities were discovered in php5, a server-side,
HTML-embedded scripting language. An attacker could cause denial of
service (DoS), memory corruption and potentially execution of
arbitrary code, and server-side request forgery (SSRF) bypass.
CVE-2019-18218
fileinfo: cdf_read_property_info in cdf.c does not restrict the
number of CDF_VECTOR elements, which allows a heap-based buffer
overflow (4-byte out-of-bounds write).
CVE-2020-7071
When validating URL with functions like filter_var($url,
FILTER_VALIDATE_URL), PHP will accept an URL with invalid password
as valid URL. This may lead to functions that rely on URL being
valid to mis-parse the URL and produce wrong data as components of
the URL.
CVE-2021-21702
When using SOAP extension to connect to a SOAP server, a malicious
SOAP server could return malformed XML data as a response that
would cause PHP to access a null pointer and thus cause a crash.
CVE-2021-21704
Multiple firebird issues.
CVE-2021-21705
SSRF bypass in FILTER_VALIDATE_URL.
For Debian 9 stretch, these problems have been fixed in version
7.0.33-0+deb9u11.
We recommend that you upgrade your php7.0 packages.
For the detailed security status of php7.0 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/php7.0
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmDwMQoACgkQDTl9HeUl
XjBOlg//YOQdGeU+Gw2PydOPIVG9S4i8bXlSZcyrcPIVbEH7UvteGuP3y58IfYcS
JBQ55PVYMP7IiPX6htXXso5UYYlb4pFCiQ9e8loysxv3okTow4ncRQtC3TLwcx1h
klK823/0+BaSAwMRExO2YDthIuRR8KBtxGl0O8wju02059ZgxuLPgUWO6LQdlXVi
/vEKvon8oQs7AuPrfiy55OPbnX0ptCrFPOHH676qGsIRMNNrjtpsTIuBQmlhFmQ9
pFwLRqgQhN94EsQKVvpV5pDz36UbSH2goD7Go89pC4gncoiWmW57QmoqWA9LwES0
Lu5FQwSwo/fRhJcQHTg9kDe4oWX8DDDgyAxfDGh3mhXN3aRIgL3q0ZQR7Lmr0LZk
7iS6A4RvE6hT/ngr9sgeI7KfQzAYfvo/rQyMdhQ/n9neT9i5H1+It0fm+p7jwwRZ
K1iD8fMJ5zjhJKqbiEUJiGXN5Vh7raAGATUpSwjaOdS1qIuSGk2JRUg86DOxLqFE
LoS5cjt0Op5UnrBD6ei1XYo1mchaaEv752UYTijW2DJQ39UeRHlIyes0iy8HDWpc
bKuZqUINXX/bZ8WkMXem4py/c2MkDxtbhkej60bzymB67XIfsvb/2rMiFVCDkyTu
9x8N6gPiWLQtbGBlJ8BTOpXimfgEaqZcNv/pdZWSs08K+tMjBYQ=
=pK6D
-----END PGP SIGNATURE-----
Reply to: