Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2020:0341-1

Опубликовано: 15 мар. 2020
Источник: suse-cvrf

Описание

Security update for php7

This update for php7 fixes the following issues:

  • CVE-2020-7062: Fixed a null pointer dereference when using file upload functionality under specific circumstances (bsc#1165280).
  • CVE-2020-7063: Fixed an issue where adding files change the permissions to default (bsc#1165289).
  • CVE-2020-7059: Fixed an out of bounds read in php_strip_tags_ex which may have led to denial of service (bsc#1162629).
  • CVE-2020-7060: Fixed a global buffer overflow in mbfl_filt_conv_big5_wchar which may have led to memory corruption (bsc#1162632).

This update was imported from the SUSE:SLE-15:Update update project.

Список пакетов

openSUSE Leap 15.1
apache2-mod_php7-7.2.5-lp151.6.22.1
php7-7.2.5-lp151.6.22.1
php7-bcmath-7.2.5-lp151.6.22.1
php7-bz2-7.2.5-lp151.6.22.1
php7-calendar-7.2.5-lp151.6.22.1
php7-ctype-7.2.5-lp151.6.22.1
php7-curl-7.2.5-lp151.6.22.1
php7-dba-7.2.5-lp151.6.22.1
php7-devel-7.2.5-lp151.6.22.1
php7-dom-7.2.5-lp151.6.22.1
php7-embed-7.2.5-lp151.6.22.1
php7-enchant-7.2.5-lp151.6.22.1
php7-exif-7.2.5-lp151.6.22.1
php7-fastcgi-7.2.5-lp151.6.22.1
php7-fileinfo-7.2.5-lp151.6.22.1
php7-firebird-7.2.5-lp151.6.22.1
php7-fpm-7.2.5-lp151.6.22.1
php7-ftp-7.2.5-lp151.6.22.1
php7-gd-7.2.5-lp151.6.22.1
php7-gettext-7.2.5-lp151.6.22.1
php7-gmp-7.2.5-lp151.6.22.1
php7-iconv-7.2.5-lp151.6.22.1
php7-intl-7.2.5-lp151.6.22.1
php7-json-7.2.5-lp151.6.22.1
php7-ldap-7.2.5-lp151.6.22.1
php7-mbstring-7.2.5-lp151.6.22.1
php7-mysql-7.2.5-lp151.6.22.1
php7-odbc-7.2.5-lp151.6.22.1
php7-opcache-7.2.5-lp151.6.22.1
php7-openssl-7.2.5-lp151.6.22.1
php7-pcntl-7.2.5-lp151.6.22.1
php7-pdo-7.2.5-lp151.6.22.1
php7-pear-7.2.5-lp151.6.22.1
php7-pear-Archive_Tar-7.2.5-lp151.6.22.1
php7-pgsql-7.2.5-lp151.6.22.1
php7-phar-7.2.5-lp151.6.22.1
php7-posix-7.2.5-lp151.6.22.1
php7-readline-7.2.5-lp151.6.22.1
php7-shmop-7.2.5-lp151.6.22.1
php7-snmp-7.2.5-lp151.6.22.1
php7-soap-7.2.5-lp151.6.22.1
php7-sockets-7.2.5-lp151.6.22.1
php7-sodium-7.2.5-lp151.6.22.1
php7-sqlite-7.2.5-lp151.6.22.1
php7-sysvmsg-7.2.5-lp151.6.22.1
php7-sysvsem-7.2.5-lp151.6.22.1
php7-sysvshm-7.2.5-lp151.6.22.1
php7-test-7.2.5-lp151.6.22.1
php7-tidy-7.2.5-lp151.6.22.1
php7-tokenizer-7.2.5-lp151.6.22.1
php7-wddx-7.2.5-lp151.6.22.1
php7-xmlreader-7.2.5-lp151.6.22.1
php7-xmlrpc-7.2.5-lp151.6.22.1
php7-xmlwriter-7.2.5-lp151.6.22.1
php7-xsl-7.2.5-lp151.6.22.1
php7-zip-7.2.5-lp151.6.22.1
php7-zlib-7.2.5-lp151.6.22.1

Ссылки

Описание

When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash.

Затронутые продукты
openSUSE Leap 15.1:apache2-mod_php7-7.2.5-lp151.6.22.1
openSUSE Leap 15.1:php7-7.2.5-lp151.6.22.1
openSUSE Leap 15.1:php7-bcmath-7.2.5-lp151.6.22.1
openSUSE Leap 15.1:php7-bz2-7.2.5-lp151.6.22.1
Ссылки

Описание

When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.

Затронутые продукты
openSUSE Leap 15.1:apache2-mod_php7-7.2.5-lp151.6.22.1
openSUSE Leap 15.1:php7-7.2.5-lp151.6.22.1
openSUSE Leap 15.1:php7-bcmath-7.2.5-lp151.6.22.1
openSUSE Leap 15.1:php7-bz2-7.2.5-lp151.6.22.1
Ссылки

Описание

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.upload_progress.cleanup is set to 0 (disabled), and the file upload fails, the upload procedure would try to clean up data that does not exist and encounter null pointer dereference, which would likely lead to a crash.

Затронутые продукты
openSUSE Leap 15.1:apache2-mod_php7-7.2.5-lp151.6.22.1
openSUSE Leap 15.1:php7-7.2.5-lp151.6.22.1
openSUSE Leap 15.1:php7-bcmath-7.2.5-lp151.6.22.1
openSUSE Leap 15.1:php7-bz2-7.2.5-lp151.6.22.1
Ссылки

Описание

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the files are added with default permissions (0666, or all access) even if the original files on the filesystem were with more restrictive permissions. This may result in files having more lax permissions than intended when such archive is extracted.

Затронутые продукты
openSUSE Leap 15.1:apache2-mod_php7-7.2.5-lp151.6.22.1
openSUSE Leap 15.1:php7-7.2.5-lp151.6.22.1
openSUSE Leap 15.1:php7-bcmath-7.2.5-lp151.6.22.1
openSUSE Leap 15.1:php7-bz2-7.2.5-lp151.6.22.1
Ссылки
Уязвимость openSUSE-SU-2020:0341-1