CVE-2016-6292

The exif_process_user_comment function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted JPEG image.

Stack-based buffer overflow vulnerability in virtual_file_ex() (CVE-2016-6289).

Use After Free in unserialize() with Unexpected Session Deserialization (CVE-2016-6290).

Out of bound read in exif_process_IFD_in_MAKERNOTE() (CVE-2016-6291).

NULL Pointer Dereference in exif_process_user_comment() (CVE-2016-6292).

locale_accept_from_http() out-of-bounds access (CVE-2016-6294).

Use After Free Vulnerability in SNMP with GC and unserialize() (CVE-2016-6295).

heap-buffer-overflow (write) simplestring_addn() simplestring.c in php-xmlrpc (CVE-2016-6296).

Stack-based buffer overflow vulnerability in php_stream_zip_opener() (CVE-2016-6297).

The php package has been updated to version 5.6.24, fixing these issues and several other bugs. See the upstream ChangeLog for details.

The CVE-2016-6296 issue was in the xmlrpc-epi library, which has been patched.

Additionally, the timezone and php-timezonedb packages have been updated with the latest timezone data.

This update for php5 fixes the following security issues:

• CVE-2016-6128: Invalid color index not properly handled [bsc#987580]
• CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032]
• CVE-2016-6292: Null pointer dereference in exif_process_user_comment [bsc#991422]
• CVE-2016-6295: Use after free in SNMP with GC and unserialize() [bsc#991424]
• CVE-2016-6297: Stack-based buffer overflow vulnerability in php_stream_zip_opener [bsc#991426]
• CVE-2016-6291: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE [bsc#991427]
• CVE-2016-6289: Integer overflow leads to buffer overflow in virtual_file_ex [bsc#991428]
• CVE-2016-6290: Use after free in unserialize() with Unexpected Session Deserialization [bsc#991429]
• CVE-2016-5399: Improper error handling in bzread() [bsc#991430]
• CVE-2016-6296: Heap buffer overflow vulnerability in simplestring_addn in simplestring.c [bsc#991437]
• CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991434]
• CVE-2014-3587: Integer overflow in the cdf_read_property_info affecting SLES11 SP3 [bsc#987530]
• CVE-2016-6288: Buffer over-read in php_url_parse_ex [bsc#991433]
• CVE-2016-7124: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization
• CVE-2016-7125: PHP Session Data Injection Vulnerability
• CVE-2016-7126: select_colors write out-of-bounds
• CVE-2016-7127: imagegammacorrect allowed arbitrary write access
• CVE-2016-7128: Memory Leakage In exif_process_IFD_in_TIFF
• CVE-2016-7129: wddx_deserialize allowed illegal memory access
• CVE-2016-7130: wddx_deserialize null dereference
• CVE-2016-7131: wddx_deserialize null dereference with invalid xml
• CVE-2016-7132: wddx_deserialize null dereference in php_wddx_pop_element
• CVE-2016-7134: Heap overflow in the function curl_escape

This update for php7 fixes the following security issues:

• CVE-2016-6128: Invalid color index not properly handled [bsc#987580]
• CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032]
• CVE-2016-6292: Null pointer dereference in exif_process_user_comment [bsc#991422]
• CVE-2016-6295: Use after free in SNMP with GC and unserialize() [bsc#991424]
• CVE-2016-6297: Stack-based buffer overflow vulnerability in php_stream_zip_opener [bsc#991426]
• CVE-2016-6291: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE [bsc#991427]
• CVE-2016-6289: Integer overflow leads to buffer overflow in virtual_file_ex [bsc#991428]
• CVE-2016-6290: Use after free in unserialize() with Unexpected Session Deserialization [bsc#991429]
• CVE-2016-5399: Improper error handling in bzread() [bsc#991430]
• CVE-2016-6296: Heap buffer overflow vulnerability in simplestring_addn in simplestring.c [bsc#991437]
• CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991434]
• CVE-2016-4473: Invalid free() instead of efree() in phar_extract_file()
• CVE-2016-7124: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization
• CVE-2016-7125: PHP Session Data Injection Vulnerability
• CVE-2016-7126: select_colors write out-of-bounds
• CVE-2016-7127: imagegammacorrect allowed arbitrary write access
• CVE-2016-7128: Memory Leakage In exif_process_IFD_in_TIFF
• CVE-2016-7129: wddx_deserialize allowed illegal memory access
• CVE-2016-7131: wddx_deserialize null dereference with invalid xml
• CVE-2016-7132: wddx_deserialize null dereference in php_wddx_pop_element
• CVE-2016-7133: memory allocator fails to realloc small block to large one
• CVE-2016-7134: Heap overflow in the function curl_escape
• CVE-2016-7130: wddx_deserialize null dereference
• CVE-2016-7413: Use after free in wddx_deserialize
• CVE-2016-7412: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field
• CVE-2016-7417: Missing type check when unserializing SplArray
• CVE-2016-7416: Stack based buffer overflow in msgfmt_format_message
• CVE-2016-7418: Null pointer dereference in php_wddx_push_element
• CVE-2016-7414: Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile

This update for php7 fixes the following security issues:

• CVE-2016-6128: Invalid color index not properly handled [bsc#987580]
• CVE-2016-6161: global out of bounds read when encoding gif from malformed input withgd2togif [bsc#988032]
• CVE-2016-6292: Null pointer dereference in exif_process_user_comment [bsc#991422]
• CVE-2016-6295: Use after free in SNMP with GC and unserialize() [bsc#991424]
• CVE-2016-6297: Stack-based buffer overflow vulnerability in php_stream_zip_opener [bsc#991426]
• CVE-2016-6291: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE [bsc#991427]
• CVE-2016-6289: Integer overflow leads to buffer overflow in virtual_file_ex [bsc#991428]
• CVE-2016-6290: Use after free in unserialize() with Unexpected Session Deserialization [bsc#991429]
• CVE-2016-5399: Improper error handling in bzread() [bsc#991430]
• CVE-2016-6296: Heap buffer overflow vulnerability in simplestring_addn in simplestring.c [bsc#991437]
• CVE-2016-6207: Integer overflow error within _gdContributionsAlloc() [bsc#991434]
• CVE-2016-4473: Invalid free() instead of efree() in phar_extract_file()
• CVE-2016-7124: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization
• CVE-2016-7125: PHP Session Data Injection Vulnerability
• CVE-2016-7126: select_colors write out-of-bounds
• CVE-2016-7127: imagegammacorrect allowed arbitrary write access
• CVE-2016-7128: Memory Leakage In exif_process_IFD_in_TIFF
• CVE-2016-7129: wddx_deserialize allowed illegal memory access
• CVE-2016-7131: wddx_deserialize null dereference with invalid xml
• CVE-2016-7132: wddx_deserialize null dereference in php_wddx_pop_element
• CVE-2016-7133: memory allocator fails to realloc small block to large one
• CVE-2016-7134: Heap overflow in the function curl_escape
• CVE-2016-7130: wddx_deserialize null dereference
• CVE-2016-7413: Use after free in wddx_deserialize
• CVE-2016-7412: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field
• CVE-2016-7417: Missing type check when unserializing SplArray
• CVE-2016-7416: Stack based buffer overflow in msgfmt_format_message
• CVE-2016-7418: Null pointer dereference in php_wddx_push_element
• CVE-2016-7414: Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile

It was discovered that PHP incorrectly handled certain SplMinHeap::compare operations. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-4116)

It was discovered that PHP incorrectly handled recursive method calls. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8873)

It was discovered that PHP incorrectly validated certain Exception objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8876)

It was discovered that PHP header() function performed insufficient filtering for Internet Explorer. A remote attacker could possibly use this issue to perform a XSS attack. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8935)

It was discovered that PHP incorrectly handled certain locale operations. An attacker could use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5093)

It was discovered that the PHP php_html_entities() function incorrectly handled certain string lengths. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5094, CVE-2016-5095)

It was discovered that the PHP fread() function incorrectly handled certain lengths. An attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5096)

It was discovered that the PHP FastCGI Process Manager (FPM) SAPI incorrectly handled memory in the access logging feature. An attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly expose sensitive information. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5114)

It was discovered that PHP would not protect applications from contents of the HTTP_PROXY environment variable when based on the contents of the Proxy header from HTTP requests. A remote attacker could possibly use this issue in combination with scripts that honour the HTTP_PROXY variable to redirect outgoing HTTP requests. (CVE-2016-5385)

Hans Jerry Illikainen discovered that the PHP bzread() function incorrectly performed error handling. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-5399)

It was discovered that certain PHP multibyte string functions incorrectly handled memory. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2016-5768)

It was discovered that the PHP Mcrypt extension incorrectly handled memory. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5769)

It was discovered that the PHP garbage collector incorrectly handled certain objects when unserializing malicious data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue was only addressed in Ubuntu Ubuntu 14.04 LTS. (CVE-2016-5771, CVE-2016-5773)

It was discovered that PHP incorrectly handled memory when unserializing malicious xml data. A remote attacker could use this issue to cause PHP to crash, resulting in a…