what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Ubuntu Security Notice USN-2276-1

Ubuntu Security Notice USN-2276-1
Posted Jul 9, 2014
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 2276-1 - Francisco Alonso discovered that the PHP Fileinfo component incorrectly handled certain CDF documents. A remote attacker could use this issue to cause PHP to hang or crash, resulting in a denial of service. Stefan Esser discovered that PHP incorrectly handled unserializing SPL extension objects. An attacker could use this issue to execute arbitrary code. Various other issues were also addressed.

tags | advisory, remote, denial of service, arbitrary, php
systems | linux, ubuntu
advisories | CVE-2014-0207, CVE-2014-3478, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487, CVE-2014-3515, CVE-2014-4670, CVE-2014-4698, CVE-2014-4721
SHA-256 | f0afa413c180f03a02d4f33dc2cae7b277423ff65ba2c982c819ca0641ec927e

Ubuntu Security Notice USN-2276-1

Change Mirror Download
============================================================================
Ubuntu Security Notice USN-2276-1
July 09, 2014

php5 vulnerabilities
============================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 LTS
- Ubuntu 13.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS

Summary:

Several security issues were fixed in PHP.

Software Description:
- php5: HTML-embedded scripting language interpreter

Details:

Francisco Alonso discovered that the PHP Fileinfo component incorrectly
handled certain CDF documents. A remote attacker could use this issue to
cause PHP to hang or crash, resulting in a denial of service.
(CVE-2014-0207, CVE-2014-3478, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487)

Stefan Esser discovered that PHP incorrectly handled unserializing SPL
extension objects. An attacker could use this issue to execute arbitrary
code. (CVE-2014-3515)

It was discovered that PHP incorrectly handled certain SPL Iterators. An
attacker could use this issue to cause PHP to crash, resulting in a denial
of service. (CVE-2014-4670)

It was discovered that PHP incorrectly handled certain ArrayIterators. An
attacker could use this issue to cause PHP to crash, resulting in a denial
of service. (CVE-2014-4698)

Stefan Esser discovered that PHP incorrectly handled variable types when
calling phpinfo(). An attacker could use this issue to possibly gain access
to arbitrary memory, possibly containing sensitive information.
(CVE-2014-4721)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
libapache2-mod-php5 5.5.9+dfsg-1ubuntu4.3
php5-cgi 5.5.9+dfsg-1ubuntu4.3
php5-cli 5.5.9+dfsg-1ubuntu4.3
php5-fpm 5.5.9+dfsg-1ubuntu4.3

Ubuntu 13.10:
libapache2-mod-php5 5.5.3+dfsg-1ubuntu2.6
php5-cgi 5.5.3+dfsg-1ubuntu2.6
php5-cli 5.5.3+dfsg-1ubuntu2.6
php5-fpm 5.5.3+dfsg-1ubuntu2.6

Ubuntu 12.04 LTS:
libapache2-mod-php5 5.3.10-1ubuntu3.13
php5-cgi 5.3.10-1ubuntu3.13
php5-cli 5.3.10-1ubuntu3.13
php5-fpm 5.3.10-1ubuntu3.13

Ubuntu 10.04 LTS:
libapache2-mod-php5 5.3.2-1ubuntu4.26
php5-cgi 5.3.2-1ubuntu4.26
php5-cli 5.3.2-1ubuntu4.26

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2276-1
CVE-2014-0207, CVE-2014-3478, CVE-2014-3479, CVE-2014-3480,
CVE-2014-3487, CVE-2014-3515, CVE-2014-4670, CVE-2014-4698,
CVE-2014-4721

Package Information:
https://launchpad.net/ubuntu/+source/php5/5.5.9+dfsg-1ubuntu4.3
https://launchpad.net/ubuntu/+source/php5/5.5.3+dfsg-1ubuntu2.6
https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.13
https://launchpad.net/ubuntu/+source/php5/5.3.2-1ubuntu4.26
Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    0 Files
  • 3
    Feb 3rd
    0 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    0 Files
  • 7
    Feb 7th
    0 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close