[ubuntu/eoan-security] php7.3 7.3.11-0ubuntu0.19.10.2 (Accepted)

[Leonidas S. Barbosa]

php7.3 (7.3.11-0ubuntu0.19.10.2) eoan-security; urgency=medium

  * SECURITY UPDATE: silently truncates
    a class after a null byte
    - debian/patches/CVE-2019-11045.patch:  not accept
      arbitrary strings in ext/spl/spl_directory.c,
      ext/spl/tests/bug78863.phpt.
    - CVE-2019-11045
  * SECURITY UPDATE: Buffer underflow
    - debian/patches/CVE-2019-11046.patch: not rely on `isdigit()`
      to detect digits in ext/bcmath/libbcmath/src/str2num.c,
      ext/bcmath/tests/bug78878.phpt.
    - CVE-2019-11046
  * SECURITY UPDATE: Heap-buffer-overflow
    - debian/patches/CVE-2019-11047.patch: fix in ext/exif/exif.c,
      ext/exif/tests/bug78910.phpt.
    - CVE-2019-11047
  * SECURITY UPDATE: Use-after-free
    - debian/patches/CVE-2019-11050.patch: fix in
      ext/exif/exif.c, ext/exif/tests/bug78793.phpt.
    - CVE-2019-11050
  * Fixing tests bug54291 and bug78878
    - debian/patches/Fixing-test-bug54291.patch: fix in
      ext/spl/tests/bug54291.phpt.
    - debian/patches/Fixing-test-78878.patch: fix in
      ext/bcmath/tests/bug78878.phpt

Date: 2020-01-14 18:40:15.772434+00:00
Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa)
https://launchpad.net/ubuntu/+source/php7.3/7.3.11-0ubuntu0.19.10.2
-------------- next part --------------
Sorry, changesfile not available.