Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2020:0397-1

Опубликовано: 18 фев. 2020
Источник: suse-cvrf

Описание

Security update for php72

This update for php72 fixes the following issues:

Security issues fixed:

  • CVE-2020-7059: Fixed an out-of-bounds read in php_strip_tags_ex (bsc#1162629).
  • CVE-2020-7060: Fixed a global buffer-overflow in mbfl_filt_conv_big5_wchar (bsc#1162632).
  • CVE-2019-20433: Fixed a buffer over-read when processing strings ending with a single '\0' byte with ucs-2 and ucs-4 encoding (bsc#1161982).

Список пакетов

SUSE Linux Enterprise Module for Web and Scripting 12
apache2-mod_php72-7.2.5-1.37.1
php72-7.2.5-1.37.1
php72-bcmath-7.2.5-1.37.1
php72-bz2-7.2.5-1.37.1
php72-calendar-7.2.5-1.37.1
php72-ctype-7.2.5-1.37.1
php72-curl-7.2.5-1.37.1
php72-dba-7.2.5-1.37.1
php72-dom-7.2.5-1.37.1
php72-enchant-7.2.5-1.37.1
php72-exif-7.2.5-1.37.1
php72-fastcgi-7.2.5-1.37.1
php72-fileinfo-7.2.5-1.37.1
php72-fpm-7.2.5-1.37.1
php72-ftp-7.2.5-1.37.1
php72-gd-7.2.5-1.37.1
php72-gettext-7.2.5-1.37.1
php72-gmp-7.2.5-1.37.1
php72-iconv-7.2.5-1.37.1
php72-imap-7.2.5-1.37.1
php72-intl-7.2.5-1.37.1
php72-json-7.2.5-1.37.1
php72-ldap-7.2.5-1.37.1
php72-mbstring-7.2.5-1.37.1
php72-mysql-7.2.5-1.37.1
php72-odbc-7.2.5-1.37.1
php72-opcache-7.2.5-1.37.1
php72-openssl-7.2.5-1.37.1
php72-pcntl-7.2.5-1.37.1
php72-pdo-7.2.5-1.37.1
php72-pear-7.2.5-1.37.1
php72-pear-Archive_Tar-7.2.5-1.37.1
php72-pgsql-7.2.5-1.37.1
php72-phar-7.2.5-1.37.1
php72-posix-7.2.5-1.37.1
php72-pspell-7.2.5-1.37.1
php72-readline-7.2.5-1.37.1
php72-shmop-7.2.5-1.37.1
php72-snmp-7.2.5-1.37.1
php72-soap-7.2.5-1.37.1
php72-sockets-7.2.5-1.37.1
php72-sodium-7.2.5-1.37.1
php72-sqlite-7.2.5-1.37.1
php72-sysvmsg-7.2.5-1.37.1
php72-sysvsem-7.2.5-1.37.1
php72-sysvshm-7.2.5-1.37.1
php72-tidy-7.2.5-1.37.1
php72-tokenizer-7.2.5-1.37.1
php72-wddx-7.2.5-1.37.1
php72-xmlreader-7.2.5-1.37.1
php72-xmlrpc-7.2.5-1.37.1
php72-xmlwriter-7.2.5-1.37.1
php72-xsl-7.2.5-1.37.1
php72-zip-7.2.5-1.37.1
php72-zlib-7.2.5-1.37.1
SUSE Linux Enterprise Software Development Kit 12 SP4
php72-devel-7.2.5-1.37.1
SUSE Linux Enterprise Software Development Kit 12 SP5
php72-devel-7.2.5-1.37.1

Ссылки

Описание

libaspell.a in GNU Aspell before 0.60.8 has a buffer over-read for a string ending with a single '\0' byte, if the encoding is set to ucs-2 or ucs-4 outside of the application, as demonstrated by the ASPELL_CONF environment variable.

Затронутые продукты
SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php72-7.2.5-1.37.1
SUSE Linux Enterprise Module for Web and Scripting 12:php72-7.2.5-1.37.1
SUSE Linux Enterprise Module for Web and Scripting 12:php72-bcmath-7.2.5-1.37.1
SUSE Linux Enterprise Module for Web and Scripting 12:php72-bz2-7.2.5-1.37.1
Ссылки

Описание

When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash.

Затронутые продукты
SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php72-7.2.5-1.37.1
SUSE Linux Enterprise Module for Web and Scripting 12:php72-7.2.5-1.37.1
SUSE Linux Enterprise Module for Web and Scripting 12:php72-bcmath-7.2.5-1.37.1
SUSE Linux Enterprise Module for Web and Scripting 12:php72-bz2-7.2.5-1.37.1
Ссылки

Описание

When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.

Затронутые продукты
SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php72-7.2.5-1.37.1
SUSE Linux Enterprise Module for Web and Scripting 12:php72-7.2.5-1.37.1
SUSE Linux Enterprise Module for Web and Scripting 12:php72-bcmath-7.2.5-1.37.1
SUSE Linux Enterprise Module for Web and Scripting 12:php72-bz2-7.2.5-1.37.1
Ссылки
Уязвимость SUSE-SU-2020:0397-1