Ubuntu Security Notice 6199-2 - USN-6199-1 fixed a vulnerability in PHP. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. It was discovered that PHP incorrectly handled certain Digest authentication for SOAP. An attacker could possibly use this issue to expose sensitive information.
e46b12e2ae2685b34c9735991a469a71e79fcd955c1df600d8da3956401fe3d8
==========================================================================
Ubuntu Security Notice USN-6199-2
October 23, 2023
php7.0, php7.2 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
PHP could be made to expose sensitive information.
Software Description:
- php7.2: HTML-embedded scripting language interpreter
- php7.0: HTML-embedded scripting language interpreter
Details:
USN-6199-1 fixed a vulnerability in PHP. This update provides the
corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
Original advisory details:
It was discovered that PHP incorrectly handled certain Digest
authentication for SOAP. An attacker could possibly use this issue
to expose sensitive information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
libapache2-mod-php7.2 7.2.24-0ubuntu0.18.04.17+esm1
php7.2 7.2.24-0ubuntu0.18.04.17+esm1
php7.2-cgi 7.2.24-0ubuntu0.18.04.17+esm1
php7.2-cli 7.2.24-0ubuntu0.18.04.17+esm1
php7.2-soap 7.2.24-0ubuntu0.18.04.17+esm1
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libapache2-mod-php7.0 7.0.33-0ubuntu0.16.04.16+esm7
php7.0 7.0.33-0ubuntu0.16.04.16+esm7
php7.0-cgi 7.0.33-0ubuntu0.16.04.16+esm7
php7.0-cli 7.0.33-0ubuntu0.16.04.16+esm7
php7.0-soap 7.0.33-0ubuntu0.16.04.16+esm7
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6199-2
https://ubuntu.com/security/notices/USN-6199-1
CVE-2023-3247