CVE-2015-2787

This update fixes the following vulnerabilities in php:

* Heap corruption issue in exif_thumbnail(). (CVE-2014-3670)
* Integer overflow in unserialize(). (CVE-2014-3669)
* Xmlrpc ISO8601 date format parsing out-of-bounds read in mkgmtime().
  (CVE-2014-3668)

Security Issues:

* CVE-2014-3669
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3669>
* CVE-2014-3670
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3670>
* CVE-2014-3668
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3668>

This update fixes the following vulnerabilities in php:

* Heap corruption issue in exif_thumbnail(). (CVE-2014-3670)
* Integer overflow in unserialize(). (CVE-2014-3669)
* Xmlrpc ISO8601 date format parsing out-of-bounds read in mkgmtime().
  (CVE-2014-3668)

Security Issues:

* CVE-2014-3669
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3669>
* CVE-2014-3670
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3670>
* CVE-2014-3668
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3668>

PHP was updated to fix ten security issues.

The following vulnerabilities were fixed:

• CVE-2014-9709: A specially crafted GIF file could cause a buffer read overflow in php-gd (bnc#923946)
• CVE-2015-2301: Memory was use after it was freed in PHAR (bnc#922022)
• CVE-2015-2305: heap overflow vulnerability in regcomp.c (bnc#922452)
• CVE-2014-9705: heap buffer overflow in Enchant (bnc#922451)
• CVE-2015-2787: use-after-free vulnerability in the process_nested_data function (bnc#924972)
• unserialize SoapClient type confusion (bnc#925109)
• CVE-2015-2348: move_uploaded_file truncates a pathNAME upon encountering a x00 character (bnc#924970)
• CVE-2015-3330: Specially crafted PHAR files could, when executed under Apache httpd 2.4 (apache2handler), allow arbitrary code execution (bnc#928506)
• CVE-2015-3329: Specially crafted PHAR data could lead to disclosure of sensitive information due to a buffer overflow (bnc#928506)
• CVE-2015-2783: Specially crafted PHAR data could lead to disclosure of sensitive information due to a buffer over-read (bnc#928511)

This update fixes the following vulnerabilities in php:

* Heap corruption issue in exif_thumbnail(). (CVE-2014-3670)
* Integer overflow in unserialize(). (CVE-2014-3669)
* Xmlrpc ISO8601 date format parsing out-of-bounds read in mkgmtime().
  (CVE-2014-3668)

Security Issues:

* CVE-2014-3669
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3669>
* CVE-2014-3670
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3670>
* CVE-2014-3668
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3668>

This update fixes the following vulnerabilities in php:

* Heap corruption issue in exif_thumbnail(). (CVE-2014-3670)
* Integer overflow in unserialize(). (CVE-2014-3669)
* Xmlrpc ISO8601 date format parsing out-of-bounds read in mkgmtime().
  (CVE-2014-3668)

Security Issues:

* CVE-2014-3669
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3669>
* CVE-2014-3670
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3670>
* CVE-2014-3668
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3668>

This update for php53 to version 5.3.17 fixes the following issues:

These security issues were fixed:

• CVE-2016-5093: get_icu_value_internal out-of-bounds read (bnc#982010).
• CVE-2016-5094: Don't create strings with lengths outside int range (bnc#982011).
• CVE-2016-5095: Don't create strings with lengths outside int range (bnc#982012).
• CVE-2016-5096: int/size_t confusion in fread (bsc#982013).
• CVE-2016-5114: fpm_log.c memory leak and buffer overflow (bnc#982162).
• CVE-2015-8879: The odbc_bindcols function in ext/odbc/php_odbc.c in PHP mishandles driver behavior for SQL_WVARCHAR columns, which allowed remote attackers to cause a denial of service (application crash) in opportunistic circumstances by leveraging use of the odbc_fetch_array function to access a certain type of Microsoft SQL Server table (bsc#981050).
• CVE-2015-4116: Use-after-free vulnerability in the spl_ptr_heap_insert function in ext/spl/spl_heap.c in PHP allowed remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation (bsc#980366).
• CVE-2015-8874: Stack consumption vulnerability in GD in PHP allowed remote attackers to cause a denial of service via a crafted imagefilltoborder call (bsc#980375).
• CVE-2015-8873: Stack consumption vulnerability in Zend/zend_exceptions.c in PHP allowed remote attackers to cause a denial of service (segmentation fault) via recursive method calls (bsc#980373).
• CVE-2016-4540: The grapheme_stripos function in ext/intl/grapheme/grapheme_string.c in PHP allowed remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset (bsc#978829).
• CVE-2016-4541: The grapheme_strpos function in ext/intl/grapheme/grapheme_string.c in PHP allowed remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset (bsc#978829.
• CVE-2016-4542: The exif_process_IFD_TAG function in ext/exif/exif.c in PHP did not properly construct spprintf arguments, which allowed remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data (bsc#978830).
• CVE-2016-4543: The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP did not validate IFD sizes, which allowed remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data (bsc#978830.
• CVE-2016-4544: The exif_process_TIFF_in_JPEG function in ext/exif/exif.c in PHP did not validate TIFF start data, which allowed remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data (bsc#978830.
• CVE-2016-4537: The bcpowmod function in ext/bcmath/bcmath.c in PHP accepted a negative integer for the scale argument, which allowed remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call (bsc#978827).
• CVE-2016-4538: The bcpowmod function in ext/bcmath/bcmath.c in PHP modified certain data structures without considering whether they are copies of the zero, one, or two global variable, which allowed remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call (bsc#978827).
• CVE-2016-4539: The xml_parse_into_struct function in ext/xml/xml.c in PHP allowed remote attackers to cause a denial of service (buffer under-read and segmentation fault) or possibly have unspecified other impact via crafted XML data in the second argument, leading to a parser level of zero (bsc#978828).
• CVE-2016-4342: ext/phar/phar_object.c in PHP mishandles zero-length uncompressed data, which allowed remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) TAR, (2) ZIP, or (3) PHAR archive (bsc#977991).
• CVE-2016-4346: Integer overflow in the str_pad function in…

Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages use of the unset function within an __wakeup function, a related issue to CVE-2015-0231.

It was discovered that PHP incorrectly handled cleanup when used with Apache 2.4. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-3330)

It was discovered that PHP incorrectly handled opening tar, zip or phar archives through the PHAR extension. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-3329)

It was discovered that PHP incorrectly handled regular expressions. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-2305)

Paulos Yibelo discovered that PHP incorrectly handled moving files when a pathname contained a null character. A remote attacker could use this issue to possibly bypass filename restrictions. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-2348)

It was discovered that PHP incorrectly handled unserializing PHAR files. A remote attacker could use this issue to cause PHP to possibly expose sensitive information. (CVE-2015-2783)

Taoguang Chen discovered that PHP incorrectly handled unserializing certain objects. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-2787)