This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============0482684275416318371== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="cndH0oD8wlq0OPvE5x4cVIKBdTRR6Cx9p"
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --cndH0oD8wlq0OPvE5x4cVIKBdTRR6Cx9p Content-Type: text/plain; charset=utf- Content-Transfer-Encoding: quoted-printable
========================================================================== Ubuntu Security Notice USN-2952-2 April 27, 2016
php5 regression ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.10
Summary:
USN-2952-1 caused a regression in PHP.
Software Description: - php5: HTML-embedded scripting language interpreter
Details:
USN-2952-1 fixed vulnerabilities in PHP. One of the backported patches caused a regression in the PHP Soap client. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the PHP Zip extension incorrectly handled directories when processing certain zip files. A remote attacker could possibly use this issue to create arbitrary directories. (CVE-2014-9767) It was discovered that the PHP Soap client incorrectly validated data types. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-8835, CVE-2016-3185) It was discovered that the PHP MySQL native driver incorrectly handled TLS connections to MySQL databases. A man in the middle attacker could possibly use this issue to downgrade and snoop on TLS connections. This vulnerability is known as BACKRONYM. (CVE-2015-8838) It was discovered that PHP incorrectly handled the imagerotate function. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive information. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2016-1903) Hans Jerry Illikainen discovered that the PHP phar extension incorrectly handled certain tar archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-2554) It was discovered that the PHP WDDX extension incorrectly handled certain malformed XML data. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-3141) It was discovered that the PHP phar extension incorrectly handled certain zip files. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2016-3142) It was discovered that the PHP libxml_disable_entity_loader() setting was shared between threads. When running under PHP-FPM, this could result in XML external entity injection and entity expansion issues. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (No CVE number) It was discovered that the PHP openssl_random_pseudo_bytes() function did not return cryptographically strong pseudo-random bytes. (No CVE number) It was discovered that the PHP Fileinfo component incorrectly handled certain magic files. An attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE number pending) It was discovered that the PHP php_snmp_error() function incorrectly handled string formatting. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE number pending) It was discovered that the PHP rawurlencode() function incorrectly handled large strings. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE number pending) It was discovered that the PHP phar extension incorrectly handled certain filenames in archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE number pending) It was discovered that the PHP mb_strcut() function incorrectly handled string formatting. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE number pending)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 15.10: libapache2-mod-php5 5.6.11+dfsg-1ubuntu3.3 php5-cgi 5.6.11+dfsg-1ubuntu3.3 php5-cli 5.6.11+dfsg-1ubuntu3.3 php5-fpm 5.6.11+dfsg-1ubuntu3.3 php5-gd 5.6.11+dfsg-1ubuntu3.3 php5-mysqlnd 5.6.11+dfsg-1ubuntu3.3 php5-snmp 5.6.11+dfsg-1ubuntu3.3
In general, a standard system update will make all the necessary changes.
References: http://www.ubuntu.com/usn/usn-2952-2 http://www.ubuntu.com/usn/usn-2952-1 https://launchpad.net/bugs/1575298
Package Information: https://launchpad.net/ubuntu/+source/php5/5.6.11+dfsg-1ubuntu3.3
--cndH0oD8wlq0OPvE5x4cVIKBdTRR6Cx9p Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE----- Version: GnuPG v2
iQIcBAEBCgAGBQJXIP0wAAoJEGVp2FWnRL6TNY0P/0Kd3FdWnll7lP0SIqghXyjt sQOqESws1dC1xzAJbGXXHI6jKJnpUQNRhnrTSC89/rCVRHu+MwuoraVR/0rHZmSR UpEgrVzS98k4ZvjiwLh9vyUniMledB7piJ/qjXhxCjQypamf+6Hx2c4T2Z99bZbL MWsSyeXbMjOP/Q5qnr4nt4DiRurXUuYMaSpViaqX25BdUjfTqgF6JDsTLfT2u30E gfdfrNLuiJH9AX0vCLleiEmRfbqTF2xrsA78ctstG5ryTPhIXunRZDFnkevKhMs+ KF3B7ALga7Mukq5GBw/Iq2HYaASo7l4tKRtlftCD+zoc5RCmuk4XqxsCsBLJqaIx UCUUlVfhuf40Gn97ApTj5MfzfjyyG7BC9nR3RTurh3egXUdCMqrV1QCI7CSZmi6O kAKHIpzzokkACcSuSHjKxzRoYvugWih8ymdiFwKQhSD9P7TywfcoPRJm+egfOvEU 7O5bvqWvHZis3HjdoC2WqbAImmOnGSotZLjdTin+yF7IC4YSjZa952zol4JlOPjU /lMHSN1SC6pdIJ6pA7HmMkcw9pc3CWBEpPC8fk1sPwWb/JldFHnPuXM+3Fld9lZN GGYA5Valos+7aH/bnpWwE/WyVHxDVAigikqpEs649W3a75pqquMvT6+z7umE2GJ8 K095oufg7K+yBKu9q6q3 =dued -----END PGP SIGNATURE-----
--cndH0oD8wlq0OPvE5x4cVIKBdTRR6Cx9p--
--===============0482684275416318371== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============0482684275416318371==--
|