CVE-2014-2497

Updated php packages fix security vulnerabilities:

The unserialize() function in PHP before 5.4.30 and 5.5.14 has a Type Confusion issue related to the SPL ArrayObject and SPLObjectStorage Types (CVE-2014-3515).

It was discovered that PHP is vulnerable to a heap-based buffer overflow in the DNS TXT record parsing. A malicious server or man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application uses dns_get_record() to perform a DNS query (CVE-2014-4049).

A flaw was found in the way file parsed property information from Composite Document Files (CDF) files, where the mconvert() function did not correctly compute the truncated pascal string size (CVE-2014-3478).

Multiple flaws were found in the way file parsed property information from Composite Document Files (CDF) files, due to insufficient boundary checks on buffers (CVE-2014-0207, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487).

PHP contains a bundled copy of the file utility's libmagic library, so it was vulnerable to this issue. It has been updated to versions 5.4.30 and 5.5.14, which fix this issue and several other bugs.

Also, PHP contains a bundled copy of the GD image library, and has been patched to correct an issue in the imagecreatefromxpm function which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file (CVE-2014-2497).

The phpinfo() function in PHP before 5.4.30 and 5.5.14 has a Type Confusion issue that can cause it to leak arbitrary process memory (CVE-2014-4721).

Additionally, php-apc has been rebuilt against the updated php packages.

The gdImageCreateFromXpm function in gdxpm.c in the gd image library allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file (CVE-2014-2497).

These are all security issues fixed in the gd-2.2.3-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the apache2-mod_php7-7.0.14-1.4 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the apache2-mod_php5-5.6.28-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the php8-8.0.11-1.1 package on the GA media of openSUSE Tumbleweed.

This update fixes the following vulnerabilities in php:

* Heap corruption issue in exif_thumbnail(). (CVE-2014-3670)
* Integer overflow in unserialize(). (CVE-2014-3669)
* Xmlrpc ISO8601 date format parsing out-of-bounds read in mkgmtime().
  (CVE-2014-3668)

Security Issues:

* CVE-2014-3669
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3669>
* CVE-2014-3670
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3670>
* CVE-2014-3668
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3668>

This update fixes the following vulnerabilities in php:

* Heap corruption issue in exif_thumbnail(). (CVE-2014-3670)
* Integer overflow in unserialize(). (CVE-2014-3669)
* Xmlrpc ISO8601 date format parsing out-of-bounds read in mkgmtime().
  (CVE-2014-3668)

Security Issues:

* CVE-2014-3669
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3669>
* CVE-2014-3670
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3670>
* CVE-2014-3668
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3668>

This update fixes the following vulnerabilities in php:

* Heap corruption issue in exif_thumbnail(). (CVE-2014-3670)
* Integer overflow in unserialize(). (CVE-2014-3669)
* Xmlrpc ISO8601 date format parsing out-of-bounds read in mkgmtime().
  (CVE-2014-3668)

Security Issues:

* CVE-2014-3669
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3669>
* CVE-2014-3670
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3670>
* CVE-2014-3668
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3668>

This update fixes the following vulnerabilities in php:

* Heap corruption issue in exif_thumbnail(). (CVE-2014-3670)
* Integer overflow in unserialize(). (CVE-2014-3669)
* Xmlrpc ISO8601 date format parsing out-of-bounds read in mkgmtime().
  (CVE-2014-3668)

Security Issues:

* CVE-2014-3669
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3669>
* CVE-2014-3670
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3670>
* CVE-2014-3668
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3668>

The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.

It was discovered that the GD library incorrectly handled certain color tables in XPM images. If a user or automated system were tricked into processing a specially crafted XPM image, an attacker could cause a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-2497)

It was discovered that the GD library incorrectly handled certain malformed GIF images. If a user or automated system were tricked into processing a specially crafted GIF image, an attacker could cause a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9709)

It was discovered that the GD library incorrectly handled memory when using gdImageFillToBorder(). A remote attacker could possibly use this issue to cause a denial of service. (CVE-2015-8874)

It was discovered that the GD library incorrectly handled memory when using gdImageScaleTwoPass(). A remote attacker could possibly use this issue to cause a denial of service. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS. (CVE-2015-8877)

Hans Jerry Illikainen discovered that the GD library incorrectly handled certain malformed GD images. If a user or automated system were tricked into processing a specially crafted GD image, an attacker could cause a denial of service or possibly execute arbitrary code. (CVE-2016-3074)