============================================================================ Ubuntu Security Notice USN-2786-1 October 28, 2015 php5 vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 15.10 - Ubuntu 15.04 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: PHP could be made to crash if it processed a specially crafted file. Software Description: - php5: HTML-embedded scripting language interpreter Details: It was discovered that the PHP phar extension incorrectly handled certain files. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2015-7803, CVE-2015-7804) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 15.10: libapache2-mod-php5 5.6.11+dfsg-1ubuntu3.1 php5-cgi 5.6.11+dfsg-1ubuntu3.1 php5-cli 5.6.11+dfsg-1ubuntu3.1 php5-fpm 5.6.11+dfsg-1ubuntu3.1 Ubuntu 15.04: libapache2-mod-php5 5.6.4+dfsg-4ubuntu6.4 php5-cgi 5.6.4+dfsg-4ubuntu6.4 php5-cli 5.6.4+dfsg-4ubuntu6.4 php5-fpm 5.6.4+dfsg-4ubuntu6.4 Ubuntu 14.04 LTS: libapache2-mod-php5 5.5.9+dfsg-1ubuntu4.14 php5-cgi 5.5.9+dfsg-1ubuntu4.14 php5-cli 5.5.9+dfsg-1ubuntu4.14 php5-fpm 5.5.9+dfsg-1ubuntu4.14 Ubuntu 12.04 LTS: libapache2-mod-php5 5.3.10-1ubuntu3.21 php5-cgi 5.3.10-1ubuntu3.21 php5-cli 5.3.10-1ubuntu3.21 php5-fpm 5.3.10-1ubuntu3.21 In general, a standard system update will make all the necessary changes. References: http://www.ubuntu.com/usn/usn-2786-1 CVE-2015-7803, CVE-2015-7804 Package Information: https://launchpad.net/ubuntu/+source/php5/5.6.11+dfsg-1ubuntu3.1 https://launchpad.net/ubuntu/+source/php5/5.6.4+dfsg-4ubuntu6.4 https://launchpad.net/ubuntu/+source/php5/5.5.9+dfsg-1ubuntu4.14 https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.21