CVE-2018-20783

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.2.24). (BZ#1726981)

Security Fix(es):

• php: Invalid memory access in function xmlrpc_decode() (CVE-2019-9020)

• php: File rename across filesystems may allow unwanted access during processing (CVE-2019-9637)

• php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9638)

• php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9639)

• php: Invalid read in exif_process_SOFn() (CVE-2019-9640)

• php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

• php: Buffer over-read in exif_read_data() (CVE-2019-11040)

• php: Buffer over-read in PHAR reading functions (CVE-2018-20783)

• php: Heap-based buffer over-read in PHAR reading functions (CVE-2019-9021)

• php: memcpy with negative length via crafted DNS response (CVE-2019-9022)

• php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

• php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c (CVE-2019-9024)

• php: Heap buffer overflow in function exif_process_IFD_TAG() (CVE-2019-11034)

• php: Heap buffer overflow in function exif_iif_add_value() (CVE-2019-11035)

• php: Buffer over-read in exif_process_IFD_TAG() leading to information disclosure (CVE-2019-11036)

• php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

• php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.2 Release Notes linked from the References section.

In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in PHAR reading functions may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse a .phar file. This is related to phar_parse_pharfile in ext/phar/phar.c.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.2.24). (BZ#1726981)

Security Fix(es):

• php: Invalid memory access in function xmlrpc_decode() (CVE-2019-9020)

• php: File rename across filesystems may allow unwanted access during processing (CVE-2019-9637)

• php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9638)

• php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9639)

• php: Invalid read in exif_process_SOFn() (CVE-2019-9640)

• php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

• php: Buffer over-read in exif_read_data() (CVE-2019-11040)

• php: Buffer over-read in PHAR reading functions (CVE-2018-20783)

• php: Heap-based buffer over-read in PHAR reading functions (CVE-2019-9021)

• php: memcpy with negative length via crafted DNS response (CVE-2019-9022)

• php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

• php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c (CVE-2019-9024)

• php: Heap buffer overflow in function exif_process_IFD_TAG() (CVE-2019-11034)

• php: Heap buffer overflow in function exif_iif_add_value() (CVE-2019-11035)

• php: Buffer over-read in exif_process_IFD_TAG() leading to information disclosure (CVE-2019-11036)

• php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)

• php: Heap buffer over-read in exif_process_user_comment() (CVE-2019-11042)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2018-14883: fix integer overflow leading to heap buffer overflow in exif_thumbnail_extract
• CVE-2019-19246: fix heap buffer overflow in oniguruma str_lower_case_match
• CVE-2018-19518: disable imap rsh/ssh by default to prevent argument injection (imap.enable_insecure_rsh INI added)
• CVE-2018-20783: add buffer bounds checks to phar_parse_pharfile manifest reads

• CVE-2018-14883: fix int overflow leading to heap overflow in exif_thumbnail_extract
• CVE-2019-6977: fix imagecolormatch out-of-bounds write on heap in GD
• CVE-2019-9022: fix memcpy with negative length via crafted DNS response
• CVE-2019-9640: fix invalid read in exif_process_SOFn
• CVE-2019-11042: fix heap buffer overflow in exif_process_user_comment
• CVE-2019-9638, CVE-2019-9639: fix uninitialized read in exif_process_IFD_in_MAKERNOTE (single upstream commit covers both)
• CVE-2019-9637: safer rename() procedure to avoid permission leak on EXDEV cross-filesystem fallback
• CVE-2019-19246: fix Oniguruma out-of-bounds read in str_lower_case_match
• CVE-2019-9024: fix xmlrpc base64 out-of-bounds read via unsigned char cast
• CVE-2018-20783: fix phar_parse_pharfile buffer over-read via stricter manifest bounds checks
• CVE-2018-19518: disable rsh/ssh logins in imap_open by default (new no_rsh/no_ssh INI entries)
• CVE-2018-19935: fix imap_mail NULL pointer dereference on empty message parameter

This update for php7 fixes the following issues:

Security issues fixed:

• CVE-2019-9637: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128892).
• CVE-2019-9675: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128886).
• CVE-2019-9638: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension ((bsc#1128889).
• CVE-2019-9639: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128887).
• CVE-2019-9640: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128883).
• CVE-2019-9022: Fixed a vulnerability which could allow a hostile DNS server to make PHP misuse memcpy (bsc#1126827).
• CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server to cause memory read outside the allocated areas (bsc#1126821).
• CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711).
• CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1127122).
• CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713).
• CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823).
• CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation of rename function (bsc#1128722).
• CVE-2018-19935: Fixed a Denial of Service in php_imap.c which could be triggered via an empty string in the message argument to imap_mail (bsc#1118832).
• CVE-2019-11034: Fixed a heap-buffer overflow in php_ifd_get32si() (bsc#1132838).
• CVE-2019-11035: Fixed a heap-buffer overflow in exif_iif_add_value() (bsc#1132837).
• CVE-2019-11036: Fixed buffer over-read in exif_process_IFD_TAG function leading to information disclosure (bsc#1134322).

Other issue addressed:

• Deleted README.default_socket_timeout which is not needed anymore (bsc#1129032).
• Enabled php7 testsuite (bsc#1119396).

This update was imported from the SUSE:SLE-15:Update update project.

This update for php7 fixes the following issues:

Security issues fixed:

• CVE-2019-9637: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128892).
• CVE-2019-9675: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128886).
• CVE-2019-9638: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension ((bsc#1128889).
• CVE-2019-9639: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128887).
• CVE-2019-9640: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128883).
• CVE-2019-9022: Fixed a vulnerability which could allow a hostile DNS server to make PHP misuse memcpy (bsc#1126827).
• CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server to cause memory read outside the allocated areas (bsc#1126821).
• CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711).
• CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1127122).
• CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713).
• CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823).
• CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation of rename function (bsc#1128722).
• CVE-2018-19935: Fixed a Denial of Service in php_imap.c which could be triggered via an empty string in the message argument to imap_mail (bsc#1118832).
• CVE-2019-11034: Fixed a heap-buffer overflow in php_ifd_get32si() (bsc#1132838).
• CVE-2019-11035: Fixed a heap-buffer overflow in exif_iif_add_value() (bsc#1132837).
• CVE-2019-11036: Fixed buffer over-read in exif_process_IFD_TAG function leading to information disclosure (bsc#1134322).

Other issue addressed:

• Deleted README.default_socket_timeout which is not needed anymore (bsc#1129032).
• Enabled php7 testsuite (bsc#1119396).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the php7-7.4.24-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the php8-8.0.11-1.1 package on the GA media of openSUSE Tumbleweed.

This update provides PHP 7.2 and subpackages to the SUSE Linux Enterprise 12 Web and Scripting Module.

It is a replacement of the php7 packages, the packages do not co-exist.

The mcrypt extensions was removed in PHP 7.2.

This update for php5 fixes the following issues:

Security issues fixed:

• CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server to cause memory read outside the allocated areas (bsc#1126821).
• CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711).
• CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1127122).
• CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713).
• CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823).
• CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation of rename function (bsc#1128722).

This update for php53 fixes the following issues:

Security issues fixed:

• CVE-2019-9637: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128892).
• CVE-2019-9675: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128886).
• CVE-2019-9638: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension ((bsc#1128889).
• CVE-2019-9639: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128887).
• CVE-2019-9640: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128883).
• CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server to cause memory read outside the allocated areas (bsc#1126821).
• CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711).
• CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1127122).
• CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713).
• CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823).
• CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation of rename function (bsc#1128722).

This update for php7 fixes the following issues:

Security issues fixed:

• CVE-2019-9637: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128892).
• CVE-2019-9675: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128886).
• CVE-2019-9638: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension ((bsc#1128889).
• CVE-2019-9639: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128887).
• CVE-2019-9640: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128883).
• CVE-2019-9022: Fixed a vulnerability which could allow a hostile DNS server to make PHP misuse memcpy (bsc#1126827).
• CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server to cause memory read outside the allocated areas (bsc#1126821).
• CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711).
• CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1127122).
• CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713).
• CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823).
• CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation of rename function (bsc#1128722).
• CVE-2018-19935: Fixed a Denial of Service in php_imap.c which could be triggered via an empty string in the message argument to imap_mail (bsc#1118832).
• CVE-2019-11034: Fixed a heap-buffer overflow in php_ifd_get32si() (bsc#1132838).
• CVE-2019-11035: Fixed a heap-buffer overflow in exif_iif_add_value() (bsc#1132837).
• CVE-2019-11036: Fixed buffer over-read in exif_process_IFD_TAG function leading to information disclosure (bsc#1134322).

Other issue addressed:

• Deleted README.default_socket_timeout which is not needed anymore (bsc#1129032).
• Enabled php7 testsuite (bsc#1119396).

This update for php7 fixes the following issues:

• Version update to 7.2.34 [jsc#SLE-23639]

• CVE-2022-37454: Fixed SHA-3 buffer overflow (bsc#1204577).

• Fix integer overflow in PHP_SHA3##bits (bsc#1204577#c26).

USN-3566-1 fixed several vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

It was discovered that PHP incorrectly handled certain files. An attacker could possibly use this issue to access sensitive information. (CVE-2018-20783)

It was discovered that PHP incorrectly handled certain files. An attacker could possibly use this issue to access sensitive information or possibly cause a crash, resulting in a denial of service. (CVE-2019-11036)

Original advisory details:

It was discovered that PHP incorrectly handled memory when unserializing certain data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 ESM. (CVE-2017-12933)

It was discovered that PHP incorrectly handled locale length. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 ESM. (CVE-2017-11362)

It was discovered that PHP incorrectly handled certain stream metadata. A remote attacker could possibly use this issue to set arbitrary metadata. This issue only affected Ubuntu 12.04 ESM. (CVE-2016-10712)