Ubuntu Security Notice 1761-1 - It was discovered that PHP incorrectly handled XML external entities in SOAP WSDL files. A remote attacker could use this flaw to read arbitrary files off the server.
a139f03fd0b8a9c748ca3fca8449ab784e6431886e31fd02762b622672ee72b4
==========================================================================
Ubuntu Security Notice USN-1761-1
March 13, 2013
php5 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 10.04 LTS
- Ubuntu 8.04 LTS
Summary:
PHP could be made to expose sensitive information over the network.
Software Description:
- php5: HTML-embedded scripting language interpreter
Details:
It was discovered that PHP incorrectly handled XML external entities in
SOAP WSDL files. A remote attacker could use this flaw to read arbitrary
files off the server.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.10:
php5 5.4.6-1ubuntu1.2
Ubuntu 12.04 LTS:
php5 5.3.10-1ubuntu3.6
Ubuntu 11.10:
php5 5.3.6-13ubuntu3.10
Ubuntu 10.04 LTS:
php5 5.3.2-1ubuntu4.19
Ubuntu 8.04 LTS:
php5 5.2.4-2ubuntu5.27
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1761-1
CVE-2013-1643
Package Information:
https://launchpad.net/ubuntu/+source/php5/5.4.6-1ubuntu1.2
https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.6
https://launchpad.net/ubuntu/+source/php5/5.3.6-13ubuntu3.10
https://launchpad.net/ubuntu/+source/php5/5.3.2-1ubuntu4.19
https://launchpad.net/ubuntu/+source/php5/5.2.4-2ubuntu5.27