CVE-2018-5712

An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.

• Fix bug #69720: Null pointer dereference in phar_get_fp_offset()
• Fix bug #70728: Type Confusion Vulnerability in PHP_to_XMLRPC_worker()
• Fix bug #70661: Use After Free Vulnerability in WDDX Packet Deserialization
• Fix bug #70741: Session WDDX Packet Deserialization Type Confusion Vulnerability
• Fix bug #71459: Integer overflow in iptcembed()
• Fix bug #71039: exec functions ignore length but look for NULL termination
• Fix bug #71354: Heap corruption in tar/zip/phar parser.
• Fix bug #71391: NULL Pointer Dereference in phar_tar_setupmetadata()
• Fix bug #71323: Output of stream_get_meta_data can be falsified by its input
• Fix bug #71498: Out-of-Bound Read in phar_parse_zipfile()
• Fix bug #71587: Use-After-Free / Double-Free in WDDX Deserialize
• Fix bug #71860: Invalid memory write in phar on filename with \0 in name
• Fix bug #71798: Integer Overflow in php_raw_url_encode
• Fix bug #72837: integer overflow in bzdecompress caused heap corruption
• Fix bug #72681: PHP Session Data Injection Vulnerability
• Fix bug #72807: integer overflow in curl_escape caused heap corruption
• Fix bug #72838: Integer overflow lead to heap corruption in sql_regcase
• Fix bug #72697: select_colors write out-of-bounds
• Fix bug #72730: imagegammacorrect allows arbitrary write access
• Fix bug #72836: integer overflow in base64_decode caused heap corruption
• Fix bug #72848: integer overflow in quoted_printable_encode caused heap corruption
• Fix bug #72849: integer overflow in urlencode caused heap corruption
• Fix bug #72850: integer overflow in php_uuencode caused heap corruption
• Fix bug #72771: ftps:// wrapper is vulnerable to protocol downgrade attack
• Fix bug #72749: wddx_deserialize allows illegal memory access
• Fix bug #72750: wddx_deserialize null dereference
• Fix bug #72790: wddx_deserialize null dereference with invalid xml
• Fix bug #72799: wddx_deserialize null dereference in php_wddx_pop_element
• Fix bug #73189: Memcpy negative size parameter php_resolve_path
• Fix bug #73150: missing NULL check in dom_document_save_html
• Fix bug #73284: heap overflow in php_ereg_replace function
• Fix bug #73218: stack-buffer-overflow through "ResourceBundle" methods
• Fix bug #73208: integer overflow in imap_8bit caused heap corruption
• Fix bug #73082: string length overflow in mb_encode_* function
• Fix bug #73174: heap overflow in php_pcre_replace_impl
• Fix bug #73276: crash in openssl_random_pseudo_bytes function
• Fix bug #73275: crash in openssl_encrypt function
• Fix bug #73017: memory corruption in wordwrap function
• Fix bug #73240: Write out of bounds at number_format
• Fix bug #73073: CachingIterator null dereference when convert to string
• Fix bug #73293: NULL pointer dereference in SimpleXMLElement::asXML()
• Fix bug #73356: crash in bzcompress function
• Fix bug #72696: imagefilltoborder stackoverflow on truecolor images
• Fix bug #73418: Integer Overflow in "_php_imap_mail" leads Heap Overflow
• Fix bug #73144: Use-after-free in ArrayObject Deserialization
• Fix bug #73192: parse_url return wrong hostname
• Fix bug #73331: NULL Pointer Dereference in WDDX Packet Deserialization with PDORow
• Fix bug #73452: Segfault (Regression for #69152)
• Fix bug #73631: Invalid read when wddx decodes empty boolean element
• Fix bug #67587: Redirection loop on nginx with FPM
• Fix bug #71465: PHAR doesn't know about litespeed
• Fix bug #73737: FPE when parsing a tag format
• Fix bug #73868: Fix DOS vulnerability in gdImageCreateFromGd2Ctx()
• Fix bug #73869: Signed Integer Overflow gd_io.c
• Fix bug #73773: Seg fault when loading hostile phar
• Fix bug #70436: Use After Free Vulnerability in unserialize()
• Fix bug #74603: PHP INI Parsing Stack Buffer Overflow Vulnerability
• Fix bug #72535: arcfour encryption stream filter crashes php
• Fix bug #72434: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unseria
• Fix bug #72455: Heap Overflow due to integer overflows
• Fix bug #74782:…

• CVE-2018-5711: fix infinite loop in gdImageCreateFromGifCtx
• CVE-2018-5712: remove file name from phar stub error output (XSS)
• CVE-2018-10545: do not set PR_SET_DUMPABLE in php-fpm workers by default
• CVE-2018-10546: fail iconv_mime_decode on invalid multibyte sequences
• CVE-2018-10547: escape file name in phar fallback paths (XSS)
• CVE-2018-10548: validate LDAP value list pointer to avoid crash
• CVE-2018-14851: use MAKERNOTE length as data size in exif IFD walk
• CVE-2018-17082: reset Apache brigade after flush failure to avoid XSS
• CVE-2019-11041: reject thumbnails smaller than 4 bytes in exif scan
• CVE-2019-11045: reject NUL bytes in DirectoryIterator path argument
• CVE-2019-11046: use ASCII range check instead of locale isdigit in bcmath
• CVE-2019-11047: bound MakerNote id_string compare by value_len
• CVE-2019-11048: widen length types in rfc1867 multipart upload handler
• CVE-2019-11050: subtract loop offset from data_len in exif IFD walk

This update for php5 fixes several issues.

These security issues were fixed:

• CVE-2018-5712: Prevent reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file that allowed for information disclosure (bsc#1076220)
• CVE-2018-5711: Prevent integer signedness error that could have lead to an infinite loop via a crafted GIF file allowing for DoS (bsc#1076391)

This update for php7 fixes several issues.

These security issues were fixed:

• CVE-2018-5712: Prevent reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file that allowed for information disclosure (bsc#1076220).
• CVE-2018-5711: Prevent integer signedness error that could have lead to an infinite loop via a crafted GIF file allowing for DoS (bsc#1076391)

This update for php53 fixes several issues.

These security issues were fixed:

• CVE-2016-10712: In PHP all of the return values of stream_get_meta_data could be controlled if the input can be controlled (e.g., during file uploads). (bsc#1080234)
• CVE-2018-5712: Prevent reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file that allowed for information disclosure (bsc#1076220)
• CVE-2018-5711: Prevent integer signedness error that could have lead to an infinite loop via a crafted GIF file allowing for DoS (bsc#1076391)
• CVE-2016-5773: php_zip.c in the zip extension in PHP improperly interacted with the unserialize implementation and garbage collection, which allowed remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data containing a ZipArchive object. (bsc#986247)
• CVE-2016-5771: spl_array.c in the SPL extension in PHP improperly interacted with the unserialize implementation and garbage collection, which allowed remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data. (bsc#986391)
• CVE-2018-7584: Fixed stack-based buffer under-read while parsing an HTTPresponse in the php_stream_url_wrap_http_ex. (bsc#1083639)

It was discovered that PHP incorrectly handled the PHAR 404 error page. A remote attacker could possibly use this issue to conduct cross-site scripting (XSS) attacks. (CVE-2018-5712)

It was discovered that PHP incorrectly handled memory when unserializing certain data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-12933)

It was discovered that PHP incorrectly handled 'front of' and 'back of' date directives. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2017-16642)

It was discovered that PHP incorrectly handled certain stream metadata. A remote attacker could possibly use this issue to set arbitrary metadata. This issue only affected Ubuntu 14.04 LTS. (CVE-2016-10712)

It was discovered that PHP incorrectly handled the PHAR 404 error page. A remote attacker could possibly use this issue to conduct cross-site scripting (XSS) attacks. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2018-5712)

It was discovered that PHP incorrectly handled parsing certain HTTP responses. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2018-7584)