CVE-2014-9709

The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.

This update fixes the following vulnerabilities in php:

* Heap corruption issue in exif_thumbnail(). (CVE-2014-3670)
* Integer overflow in unserialize(). (CVE-2014-3669)
* Xmlrpc ISO8601 date format parsing out-of-bounds read in mkgmtime().
  (CVE-2014-3668)

Security Issues:

* CVE-2014-3669
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3669>
* CVE-2014-3670
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3670>
* CVE-2014-3668
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3668>

This update fixes the following vulnerabilities in php:

* Heap corruption issue in exif_thumbnail(). (CVE-2014-3670)
* Integer overflow in unserialize(). (CVE-2014-3669)
* Xmlrpc ISO8601 date format parsing out-of-bounds read in mkgmtime().
  (CVE-2014-3668)

Security Issues:

* CVE-2014-3669
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3669>
* CVE-2014-3670
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3670>
* CVE-2014-3668
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3668>

The graphics drawing library gd has been updated to fix one security issue:

* possible buffer read overflow (CVE-2014-9709)

Security Issues:

* CVE-2014-9709
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9709>

The graphics drawing library gd was updated to fix one security issue.

The following vulnerability was fixed:

• possible buffer read overflow (CVE-2014-9709)

PHP was updated to fix ten security issues.

The following vulnerabilities were fixed:

• CVE-2014-9709: A specially crafted GIF file could cause a buffer read overflow in php-gd (bnc#923946)
• CVE-2015-2301: Memory was use after it was freed in PHAR (bnc#922022)
• CVE-2015-2305: heap overflow vulnerability in regcomp.c (bnc#922452)
• CVE-2014-9705: heap buffer overflow in Enchant (bnc#922451)
• CVE-2015-2787: use-after-free vulnerability in the process_nested_data function (bnc#924972)
• unserialize SoapClient type confusion (bnc#925109)
• CVE-2015-2348: move_uploaded_file truncates a pathNAME upon encountering a x00 character (bnc#924970)
• CVE-2015-3330: Specially crafted PHAR files could, when executed under Apache httpd 2.4 (apache2handler), allow arbitrary code execution (bnc#928506)
• CVE-2015-3329: Specially crafted PHAR data could lead to disclosure of sensitive information due to a buffer overflow (bnc#928506)
• CVE-2015-2783: Specially crafted PHAR data could lead to disclosure of sensitive information due to a buffer over-read (bnc#928511)

This update fixes the following vulnerabilities in php:

* Heap corruption issue in exif_thumbnail(). (CVE-2014-3670)
* Integer overflow in unserialize(). (CVE-2014-3669)
* Xmlrpc ISO8601 date format parsing out-of-bounds read in mkgmtime().
  (CVE-2014-3668)

Security Issues:

* CVE-2014-3669
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3669>
* CVE-2014-3670
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3670>
* CVE-2014-3668
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3668>

This update fixes the following vulnerabilities in php:

* Heap corruption issue in exif_thumbnail(). (CVE-2014-3670)
* Integer overflow in unserialize(). (CVE-2014-3669)
* Xmlrpc ISO8601 date format parsing out-of-bounds read in mkgmtime().
  (CVE-2014-3668)

Security Issues:

* CVE-2014-3669
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3669>
* CVE-2014-3670
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3670>
* CVE-2014-3668
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3668>

This update for php53 to version 5.3.17 fixes the following issues:

These security issues were fixed:

• CVE-2016-5093: get_icu_value_internal out-of-bounds read (bnc#982010).
• CVE-2016-5094: Don't create strings with lengths outside int range (bnc#982011).
• CVE-2016-5095: Don't create strings with lengths outside int range (bnc#982012).
• CVE-2016-5096: int/size_t confusion in fread (bsc#982013).
• CVE-2016-5114: fpm_log.c memory leak and buffer overflow (bnc#982162).
• CVE-2015-8879: The odbc_bindcols function in ext/odbc/php_odbc.c in PHP mishandles driver behavior for SQL_WVARCHAR columns, which allowed remote attackers to cause a denial of service (application crash) in opportunistic circumstances by leveraging use of the odbc_fetch_array function to access a certain type of Microsoft SQL Server table (bsc#981050).
• CVE-2015-4116: Use-after-free vulnerability in the spl_ptr_heap_insert function in ext/spl/spl_heap.c in PHP allowed remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation (bsc#980366).
• CVE-2015-8874: Stack consumption vulnerability in GD in PHP allowed remote attackers to cause a denial of service via a crafted imagefilltoborder call (bsc#980375).
• CVE-2015-8873: Stack consumption vulnerability in Zend/zend_exceptions.c in PHP allowed remote attackers to cause a denial of service (segmentation fault) via recursive method calls (bsc#980373).
• CVE-2016-4540: The grapheme_stripos function in ext/intl/grapheme/grapheme_string.c in PHP allowed remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset (bsc#978829).
• CVE-2016-4541: The grapheme_strpos function in ext/intl/grapheme/grapheme_string.c in PHP allowed remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset (bsc#978829.
• CVE-2016-4542: The exif_process_IFD_TAG function in ext/exif/exif.c in PHP did not properly construct spprintf arguments, which allowed remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data (bsc#978830).
• CVE-2016-4543: The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP did not validate IFD sizes, which allowed remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data (bsc#978830.
• CVE-2016-4544: The exif_process_TIFF_in_JPEG function in ext/exif/exif.c in PHP did not validate TIFF start data, which allowed remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data (bsc#978830.
• CVE-2016-4537: The bcpowmod function in ext/bcmath/bcmath.c in PHP accepted a negative integer for the scale argument, which allowed remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call (bsc#978827).
• CVE-2016-4538: The bcpowmod function in ext/bcmath/bcmath.c in PHP modified certain data structures without considering whether they are copies of the zero, one, or two global variable, which allowed remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call (bsc#978827).
• CVE-2016-4539: The xml_parse_into_struct function in ext/xml/xml.c in PHP allowed remote attackers to cause a denial of service (buffer under-read and segmentation fault) or possibly have unspecified other impact via crafted XML data in the second argument, leading to a parser level of zero (bsc#978828).
• CVE-2016-4342: ext/phar/phar_object.c in PHP mishandles zero-length uncompressed data, which allowed remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) TAR, (2) ZIP, or (3) PHAR archive (bsc#977991).
• CVE-2016-4346: Integer overflow in the str_pad function in…

This update for php74 fixes the following issues:

• CVE-2022-31631: Fixed an issue where PDO::quote would return an unquoted string (bsc#1206958).

The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.

It was discovered that the GD library incorrectly handled certain color tables in XPM images. If a user or automated system were tricked into processing a specially crafted XPM image, an attacker could cause a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-2497)

It was discovered that the GD library incorrectly handled certain malformed GIF images. If a user or automated system were tricked into processing a specially crafted GIF image, an attacker could cause a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9709)

It was discovered that the GD library incorrectly handled memory when using gdImageFillToBorder(). A remote attacker could possibly use this issue to cause a denial of service. (CVE-2015-8874)

It was discovered that the GD library incorrectly handled memory when using gdImageScaleTwoPass(). A remote attacker could possibly use this issue to cause a denial of service. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2015-8877)

Hans Jerry Illikainen discovered that the GD library incorrectly handled certain malformed GD images. If a user or automated system were tricked into processing a specially crafted GD image, an attacker could cause a denial of service or possibly execute arbitrary code. (CVE-2016-3074)