SB2015070903 - Ubuntu update for PHP
Published: July 9, 2015 Updated: November 27, 2018
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 secuirty vulnerabilities.
1) Reachable assertion (CVE-ID: CVE-2014-0207)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists due to assertion failure in the cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14. A remote attacker can trigger reachable assertion via a specially crafted CDF file and cause the service to crash.
2) Buffer overflow (CVE-ID: CVE-2014-3478)
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14. A remote attacker can trigger memory corruption via a crafted Pascal string in a FILE_PSTRING conversion and cause the service to crash.
3) Input validation error (CVE-ID: CVE-2014-3479)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input when the cdf_check_stream_offset function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, relies on incorrect sector-size data. A remote attacker can cause the service to crash via a crafted stream offset in a CDF file.
4) Input validation error (CVE-ID: CVE-2014-3480)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of sector-count data by df_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14. A remote attacker can cause application crash via a crafted CDF file.
5) Input validation error (CVE-ID: CVE-2014-3487)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of a stream offset by the cdf_read_property_info function in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14. A remote attacker can cause the application to crash via a crafted CDF file.
6) Type Confusion (CVE-ID: CVE-2014-3515)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error in (1) ArrayObject and (2) SPLObjectStorage. when the SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization. A remote attacker can trigger a type confusion error via a crafted string that triggers use of a Hashtable destructor and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
7) Use-after-free (CVE-ID: CVE-2014-4670)
The vulnerability allows a local attacker to cause DoS condition.
The vulnerability exists due to use-after-free error in ext/spl/spl_dllist.c in the SPL component in PHP through 5.5.14. A local attacker can trigger memory corruption via crafted iterator usage within applications in certain web-hosting environments and cause the service to crash.
8) Use-after-free (CVE-ID: CVE-2014-4698)
The vulnerability allows a local attacker to cause DoS condition.The vulnerability exists due to use-after-free error in ext/spl/spl_array.c in the SPL component in PHP through 5.5.14. A local attacker can trigger memory corruption via crafted ArrayIterator usage within applications in certain web-hosting environments and cause the service to crash.
9) Type Confusion (CVE-ID: CVE-2014-4721)
The vulnerability allows a local attacker to obtain potentially sensitive information on the target system.
The vulnerability exists due to a type confusion error when the phpinfo implementation in ext/standard/info.c in PHP before 5.4.30 and 5.5.x before 5.5.14 does not ensure use of the string data type for the PHP_AUTH_PW, PHP_AUTH_TYPE, PHP_AUTH_USER, and PHP_SELF variables. A local attacker can use the integer data type with crafted values, as demonstrated by reading a private SSL key in an Apache HTTP Server web-hosting environment with mod_ssl and a PHP 5.3.x mod_php and obtain sensitive information.
Remediation
Install update from vendor's website.