Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2019:1573-1

Опубликовано: 18 июн. 2019
Источник: suse-cvrf

Описание

Security update for php7

This update for php7 fixes the following issues:

Security issues fixed:

  • CVE-2019-9637: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128892).
  • CVE-2019-9675: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128886).
  • CVE-2019-9638: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension ((bsc#1128889).
  • CVE-2019-9639: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128887).
  • CVE-2019-9640: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128883).
  • CVE-2019-9022: Fixed a vulnerability which could allow a hostile DNS server to make PHP misuse memcpy (bsc#1126827).
  • CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server to cause memory read outside the allocated areas (bsc#1126821).
  • CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711).
  • CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1127122).
  • CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713).
  • CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823).
  • CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation of rename function (bsc#1128722).
  • CVE-2018-19935: Fixed a Denial of Service in php_imap.c which could be triggered via an empty string in the message argument to imap_mail (bsc#1118832).
  • CVE-2019-11034: Fixed a heap-buffer overflow in php_ifd_get32si() (bsc#1132838).
  • CVE-2019-11035: Fixed a heap-buffer overflow in exif_iif_add_value() (bsc#1132837).
  • CVE-2019-11036: Fixed buffer over-read in exif_process_IFD_TAG function leading to information disclosure (bsc#1134322).

Other issue addressed:

  • Deleted README.default_socket_timeout which is not needed anymore (bsc#1129032).
  • Enabled php7 testsuite (bsc#1119396).

This update was imported from the SUSE:SLE-15:Update update project.

Список пакетов

openSUSE Leap 15.0
apache2-mod_php7-7.2.5-lp150.2.19.1
php7-7.2.5-lp150.2.19.1
php7-bcmath-7.2.5-lp150.2.19.1
php7-bz2-7.2.5-lp150.2.19.1
php7-calendar-7.2.5-lp150.2.19.1
php7-ctype-7.2.5-lp150.2.19.1
php7-curl-7.2.5-lp150.2.19.1
php7-dba-7.2.5-lp150.2.19.1
php7-devel-7.2.5-lp150.2.19.1
php7-dom-7.2.5-lp150.2.19.1
php7-embed-7.2.5-lp150.2.19.1
php7-enchant-7.2.5-lp150.2.19.1
php7-exif-7.2.5-lp150.2.19.1
php7-fastcgi-7.2.5-lp150.2.19.1
php7-fileinfo-7.2.5-lp150.2.19.1
php7-firebird-7.2.5-lp150.2.19.1
php7-fpm-7.2.5-lp150.2.19.1
php7-ftp-7.2.5-lp150.2.19.1
php7-gd-7.2.5-lp150.2.19.1
php7-gettext-7.2.5-lp150.2.19.1
php7-gmp-7.2.5-lp150.2.19.1
php7-iconv-7.2.5-lp150.2.19.1
php7-intl-7.2.5-lp150.2.19.1
php7-json-7.2.5-lp150.2.19.1
php7-ldap-7.2.5-lp150.2.19.1
php7-mbstring-7.2.5-lp150.2.19.1
php7-mysql-7.2.5-lp150.2.19.1
php7-odbc-7.2.5-lp150.2.19.1
php7-opcache-7.2.5-lp150.2.19.1
php7-openssl-7.2.5-lp150.2.19.1
php7-pcntl-7.2.5-lp150.2.19.1
php7-pdo-7.2.5-lp150.2.19.1
php7-pear-7.2.5-lp150.2.19.1
php7-pear-Archive_Tar-7.2.5-lp150.2.19.1
php7-pgsql-7.2.5-lp150.2.19.1
php7-phar-7.2.5-lp150.2.19.1
php7-posix-7.2.5-lp150.2.19.1
php7-readline-7.2.5-lp150.2.19.1
php7-shmop-7.2.5-lp150.2.19.1
php7-snmp-7.2.5-lp150.2.19.1
php7-soap-7.2.5-lp150.2.19.1
php7-sockets-7.2.5-lp150.2.19.1
php7-sodium-7.2.5-lp150.2.19.1
php7-sqlite-7.2.5-lp150.2.19.1
php7-sysvmsg-7.2.5-lp150.2.19.1
php7-sysvsem-7.2.5-lp150.2.19.1
php7-sysvshm-7.2.5-lp150.2.19.1
php7-testresults-7.2.5-lp150.2.19.1
php7-tidy-7.2.5-lp150.2.19.1
php7-tokenizer-7.2.5-lp150.2.19.1
php7-wddx-7.2.5-lp150.2.19.1
php7-xmlreader-7.2.5-lp150.2.19.1
php7-xmlrpc-7.2.5-lp150.2.19.1
php7-xmlwriter-7.2.5-lp150.2.19.1
php7-xsl-7.2.5-lp150.2.19.1
php7-zip-7.2.5-lp150.2.19.1
php7-zlib-7.2.5-lp150.2.19.1

Ссылки

Описание

ext/imap/php_imap.c in PHP 5.x and 7.x before 7.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty string in the message argument to the imap_mail function.

Затронутые продукты
openSUSE Leap 15.0:apache2-mod_php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bcmath-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bz2-7.2.5-lp150.2.19.1
Ссылки

Описание

In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.

Затронутые продукты
openSUSE Leap 15.0:apache2-mod_php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bcmath-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bz2-7.2.5-lp150.2.19.1
Ссылки

Описание

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.

Затронутые продукты
openSUSE Leap 15.0:apache2-mod_php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bcmath-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bz2-7.2.5-lp150.2.19.1
Ссылки

Описание

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.

Затронутые продукты
openSUSE Leap 15.0:apache2-mod_php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bcmath-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bz2-7.2.5-lp150.2.19.1
Ссылки

Описание

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.

Затронутые продукты
openSUSE Leap 15.0:apache2-mod_php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bcmath-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bz2-7.2.5-lp150.2.19.1
Ссылки

Описание

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc/xml_element.c.

Затронутые продукты
openSUSE Leap 15.0:apache2-mod_php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bcmath-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bz2-7.2.5-lp150.2.19.1
Ссылки

Описание

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file name, a different vulnerability than CVE-2018-20783. This is related to phar_detect_phar_fname_ext in ext/phar/phar.c.

Затронутые продукты
openSUSE Leap 15.0:apache2-mod_php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bcmath-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bz2-7.2.5-lp150.2.19.1
Ссылки

Описание

An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parserr in ext/standard/dns.c for DNS_CAA and DNS_ANY queries.

Затронутые продукты
openSUSE Leap 15.0:apache2-mod_php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bcmath-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bz2-7.2.5-lp150.2.19.1
Ссылки

Описание

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcomp.c, ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c, and ext/mbstring/oniguruma/src/utf32_be.c when a multibyte regular expression pattern contains invalid multibyte sequences.

Затронутые продукты
openSUSE Leap 15.0:apache2-mod_php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bcmath-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bz2-7.2.5-lp150.2.19.1
Ссылки

Описание

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpc_decode() can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c.

Затронутые продукты
openSUSE Leap 15.0:apache2-mod_php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bcmath-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bz2-7.2.5-lp150.2.19.1
Ссылки

Описание

An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() across filesystems is implemented, it is possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to access the data.

Затронутые продукты
openSUSE Leap 15.0:apache2-mod_php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bcmath-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bz2-7.2.5-lp150.2.19.1
Ссылки

Описание

An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the maker_note->offset relationship to value_len.

Затронутые продукты
openSUSE Leap 15.0:apache2-mod_php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bcmath-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bz2-7.2.5-lp150.2.19.1
Ссылки

Описание

An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the data_len variable.

Затронутые продукты
openSUSE Leap 15.0:apache2-mod_php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bcmath-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bz2-7.2.5-lp150.2.19.1
Ссылки

Описание

An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an Invalid Read in exif_process_SOFn.

Затронутые продукты
openSUSE Leap 15.0:apache2-mod_php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bcmath-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bz2-7.2.5-lp150.2.19.1
Ссылки

Описание

An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_TIFF.

Затронутые продукты
openSUSE Leap 15.0:apache2-mod_php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bcmath-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bz2-7.2.5-lp150.2.19.1
Ссылки

Описание

** DISPUTED ** An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: "This issue allows theoretical compromise of security, but a practical attack is usually impossible."

Затронутые продукты
openSUSE Leap 15.0:apache2-mod_php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bcmath-7.2.5-lp150.2.19.1
openSUSE Leap 15.0:php7-bz2-7.2.5-lp150.2.19.1
Ссылки
Уязвимость openSUSE-SU-2019:1573-1