CVE-2018-10547

An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-5712.

• CVE-2018-5711: fix infinite loop in gdImageCreateFromGifCtx
• CVE-2018-5712: remove file name from phar stub error output (XSS)
• CVE-2018-10545: do not set PR_SET_DUMPABLE in php-fpm workers by default
• CVE-2018-10546: fail iconv_mime_decode on invalid multibyte sequences
• CVE-2018-10547: escape file name in phar fallback paths (XSS)
• CVE-2018-10548: validate LDAP value list pointer to avoid crash
• CVE-2018-14851: use MAKERNOTE length as data size in exif IFD walk
• CVE-2018-17082: reset Apache brigade after flush failure to avoid XSS
• CVE-2019-11041: reject thumbnails smaller than 4 bytes in exif scan
• CVE-2019-11045: reject NUL bytes in DirectoryIterator path argument
• CVE-2019-11046: use ASCII range check instead of locale isdigit in bcmath
• CVE-2019-11047: bound MakerNote id_string compare by value_len
• CVE-2019-11048: widen length types in rfc1867 multipart upload handler
• CVE-2019-11050: subtract loop offset from data_len in exif IFD walk

• Heap Buffer Overflow (READ: 1786) in exif_iif_add_value (CVE-2018-10549)
• Stream filter convert.iconv leads to infinite loop on invalid sequence (CVE-2018-10546)
• Malicious LDAP-Server Response causes Crash. (CVE-2018-10548)
• incomplete PHAR Fix (CVE-2018-10547)

This update for php7 fixes the following issues:

Security issues fixed:

• CVE-2018-10545: Fix access controls in FPM child processes (bsc#1091367).
• CVE-2018-10547: Fix Reflected XSS on the PHAR 403 and 404 error pages (bsc#1091362).
• CVE-2018-10546: Fix an infinite loop exists in ext/iconv/iconv.c (bsc#1091363).
• CVE-2018-10548: Fix remote denial of service in ext/ldap/ldap.c (bsc#1091355).

This update for php5 fixes the following issues:

Security issues fixed:

• CVE-2018-10545: Fix access controls in FPM child processes (bsc#1091367).
• CVE-2018-10547: Fix Reflected XSS on the PHAR 403 and 404 error pages (bsc#1091362).
• CVE-2018-10546: Fix an infinite loop exists in ext/iconv/iconv.c (bsc#1091363).
• CVE-2018-10548: Fix remote denial of service in ext/ldap/ldap.c (bsc#1091355).

This update for php53 fixes the following issues:

Security issues fixed:

• CVE-2018-10545: Fix access controls in FPM child processes (bsc#1091367).
• CVE-2018-10547: Fix Reflected XSS on the PHAR 403 and 404 error pages (bsc#1091362).
• CVE-2018-10546: Fix an infinite loop exists in ext/iconv/iconv.c (bsc#1091363).
• CVE-2018-10548: Fix remote denial of service in ext/ldap/ldap.c (bsc#1091355).

It was discovered that PHP incorrectly handled opcache access controls when configured to use PHP-FPM. A local user could possibly use this issue to obtain sensitive information from another user's PHP applications. (CVE-2018-10545)

It was discovered that the PHP iconv stream filter incorrect handled certain invalid multibyte sequences. A remote attacker could possibly use this issue to cause PHP to hang, resulting in a denial of service. (CVE-2018-10546)

It was discovered that the PHP PHAR error pages incorrectly filtered certain data. A remote attacker could possibly use this issue to perform a reflected XSS attack. (CVE-2018-10547)

It was discovered that PHP incorrectly handled LDAP. A malicious remote LDAP server could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2018-10548)

It was discovered that PHP incorrectly handled certain exif tags in JPEG images. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 17.10, and Ubuntu 18.04 LTS. (CVE-2018-10549)