CVE-2018-10545

An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call, allowing one user (in a multiuser environment) to obtain sensitive information from the process memory of a second user's PHP applications by running gcore on the PID of the PHP-FPM worker process.

• CVE-2018-5711: Fix infinite loop in gdImageCreateFromGifCtx (libgd) when reading crafted GIF
• CVE-2018-17082: Fix XSS via Transfer-Encoding: chunked in apache2 SAPI
• CVE-2018-10545: Do not set PR_SET_DUMPABLE by default in php-fpm child

• CVE-2018-5711: fix infinite loop in gdImageCreateFromGifCtx
• CVE-2018-5712: remove file name from phar stub error output (XSS)
• CVE-2018-10545: do not set PR_SET_DUMPABLE in php-fpm workers by default
• CVE-2018-10546: fail iconv_mime_decode on invalid multibyte sequences
• CVE-2018-10547: escape file name in phar fallback paths (XSS)
• CVE-2018-10548: validate LDAP value list pointer to avoid crash
• CVE-2018-14851: use MAKERNOTE length as data size in exif IFD walk
• CVE-2018-17082: reset Apache brigade after flush failure to avoid XSS
• CVE-2019-11041: reject thumbnails smaller than 4 bytes in exif scan
• CVE-2019-11045: reject NUL bytes in DirectoryIterator path argument
• CVE-2019-11046: use ASCII range check instead of locale isdigit in bcmath
• CVE-2019-11047: bound MakerNote id_string compare by value_len
• CVE-2019-11048: widen length types in rfc1867 multipart upload handler
• CVE-2019-11050: subtract loop offset from data_len in exif IFD walk

This update for php7 fixes the following issues:

Security issues fixed:

• CVE-2018-10545: Fix access controls in FPM child processes (bsc#1091367).
• CVE-2018-10547: Fix Reflected XSS on the PHAR 403 and 404 error pages (bsc#1091362).
• CVE-2018-10546: Fix an infinite loop exists in ext/iconv/iconv.c (bsc#1091363).
• CVE-2018-10548: Fix remote denial of service in ext/ldap/ldap.c (bsc#1091355).

This update for php5 fixes the following issues:

Security issues fixed:

• CVE-2018-10545: Fix access controls in FPM child processes (bsc#1091367).
• CVE-2018-10547: Fix Reflected XSS on the PHAR 403 and 404 error pages (bsc#1091362).
• CVE-2018-10546: Fix an infinite loop exists in ext/iconv/iconv.c (bsc#1091363).
• CVE-2018-10548: Fix remote denial of service in ext/ldap/ldap.c (bsc#1091355).

This update for php53 fixes the following issues:

Security issues fixed:

• CVE-2018-10545: Fix access controls in FPM child processes (bsc#1091367).
• CVE-2018-10547: Fix Reflected XSS on the PHAR 403 and 404 error pages (bsc#1091362).
• CVE-2018-10546: Fix an infinite loop exists in ext/iconv/iconv.c (bsc#1091363).
• CVE-2018-10548: Fix remote denial of service in ext/ldap/ldap.c (bsc#1091355).

It was discovered that PHP incorrectly handled opcache access controls when configured to use PHP-FPM. A local user could possibly use this issue to obtain sensitive information from another user's PHP applications. (CVE-2018-10545)

It was discovered that the PHP iconv stream filter incorrect handled certain invalid multibyte sequences. A remote attacker could possibly use this issue to cause PHP to hang, resulting in a denial of service. (CVE-2018-10546)

It was discovered that the PHP PHAR error pages incorrectly filtered certain data. A remote attacker could possibly use this issue to perform a reflected XSS attack. (CVE-2018-10547)

It was discovered that PHP incorrectly handled LDAP. A malicious remote LDAP server could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2018-10548)

It was discovered that PHP incorrectly handled certain exif tags in JPEG images. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 17.10, and Ubuntu 18.04 LTS. (CVE-2018-10549)