CVE-2018-14883

An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. An Integer Overflow leads to a heap-based buffer over-read in exif_thumbnail_extract of exif.c.

• CVE-2018-14883: fix integer overflow leading to heap buffer overflow in exif_thumbnail_extract
• CVE-2019-19246: fix heap buffer overflow in oniguruma str_lower_case_match
• CVE-2018-19518: disable imap rsh/ssh by default to prevent argument injection (imap.enable_insecure_rsh INI added)
• CVE-2018-20783: add buffer bounds checks to phar_parse_pharfile manifest reads

• CVE-2018-14883: fix int overflow leading to heap overflow in exif_thumbnail_extract
• CVE-2019-6977: fix imagecolormatch out-of-bounds write on heap in GD
• CVE-2019-9022: fix memcpy with negative length via crafted DNS response
• CVE-2019-9640: fix invalid read in exif_process_SOFn
• CVE-2019-11042: fix heap buffer overflow in exif_process_user_comment
• CVE-2019-9638, CVE-2019-9639: fix uninitialized read in exif_process_IFD_in_MAKERNOTE (single upstream commit covers both)
• CVE-2019-9637: safer rename() procedure to avoid permission leak on EXDEV cross-filesystem fallback
• CVE-2019-19246: fix Oniguruma out-of-bounds read in str_lower_case_match
• CVE-2019-9024: fix xmlrpc base64 out-of-bounds read via unsigned char cast
• CVE-2018-20783: fix phar_parse_pharfile buffer over-read via stricter manifest bounds checks
• CVE-2018-19518: disable rsh/ssh logins in imap_open by default (new no_rsh/no_ssh INI entries)
• CVE-2018-19935: fix imap_mail NULL pointer dereference on empty message parameter

• Int Overflow lead to Heap OverFlow in exif_thumbnail_extract of exif.c (CVE-2018-14883)
• heap-buffer-overflow (READ of size 48) while reading exif data (CVE-2018-14851)
• XSS due to the header Transfer-Encoding: chunked

This update for php53 fixes the following issues:

The following security issues were fixed:

• CVE-2018-14851: Fixed an out-of-bound read in exif_process_IFD_in_MAKERNOTE, which could be exploited by an attacker via crafted JPG files, and could result in an application crash. (bsc#1103659)
• CVE-2018-14883: Fixed an integer overflow leading to a heap based buffer over-read in exif_thumbnail_extract of exif.c. (bsc#1103836)
• CVE-2017-9118: Fixed an out of bounds access in php_pcre_replace_impl via a crafted preg_replace call (bsc#1105466)

It was discovered that PHP incorrectly handled restarting certain child processes when php-fpm is used. A remote attacker could possibly use this issue to cause a denial of service. This issue was only addressed in Ubuntu 18.04 LTS. (CVE-2015-9253)

It was discovered that PHP incorrectly handled certain exif tags in JPEG images. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2018-14851, CVE-2018-14883)