Debian Security Advisory

DLA-1397-1 php5 -- LTS security update

Date Reported:
26 Jun 2018
Affected Packages:
php5
Vulnerable:
Yes
Security database references:
In Mitre's CVE dictionary: CVE-2018-7584, CVE-2018-10545, CVE-2018-10546, CVE-2018-10547, CVE-2018-10548, CVE-2018-10549.
More information:

Several vulnerabilities were found in PHP, a widely-used open source general purpose scripting language:

  • CVE-2018-7584

    A stack-buffer-overflow while parsing HTTP response results in copying a large string and possible memory corruption and/or denial of service

  • CVE-2018-10545

    Dumpable FPM child processes allow bypassing opcache access controls resulting in potential information disclosure where one user can obtain information about another user's running PHP applications

  • CVE-2018-10546

    An invalid sequence of bytes can trigger an infinite loop in the stream filter convert.iconv

  • CVE-2018-10547

    A previous fix for CVE-2018-5712 may not be complete, resulting in an additional vulnerability in the form of a reflected XSS in the PHAR 403 and 404 error pages

  • CVE-2018-10548

    A malicious remote LDAP server can send a crafted response that will cause a denial of service (NULL pointer dereference resulting in an application crash)

  • CVE-2018-10549

    A crafted JPEG file can case an out-of-bounds read and heap buffer overflow

For Debian 8 Jessie, these problems have been fixed in version 5.6.36+dfsg-0+deb8u1.

We recommend that you upgrade your php5 packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS