[USN-1905-1] PHP vulnerabilities

Marc Deslauriers marc.deslauriers at canonical.com
Tue Jul 16 12:40:16 UTC 2013

Ubuntu Security Notice USN-1905-1
July 16, 2013

php5 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS


Several security issues were fixed in PHP.

Software Description:
- php5: HTML-embedded scripting language interpreter


It was discovered that PHP incorrectly handled the xml_parse_into_struct
function. If a PHP application parsed untrusted XML, an attacker could use
this flaw with a specially-crafted XML document to cause PHP to crash,
resulting in a denial of service, or to possibly execute arbitrary code.

It was discovered that PHP incorrectly handled the jdtojewish function. An
attacker could use this flaw to cause PHP to crash, resulting in a denial
of service. (CVE-2013-4635)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
  libapache2-mod-php5             5.4.9-4ubuntu2.2
  php5-cgi                        5.4.9-4ubuntu2.2
  php5-cli                        5.4.9-4ubuntu2.2

Ubuntu 12.10:
  libapache2-mod-php5             5.4.6-1ubuntu1.3
  php5-cgi                        5.4.6-1ubuntu1.3
  php5-cli                        5.4.6-1ubuntu1.3

Ubuntu 12.04 LTS:
  libapache2-mod-php5             5.3.10-1ubuntu3.7
  php5-cgi                        5.3.10-1ubuntu3.7
  php5-cli                        5.3.10-1ubuntu3.7

Ubuntu 10.04 LTS:
  libapache2-mod-php5             5.3.2-1ubuntu4.20
  php5-cgi                        5.3.2-1ubuntu4.20
  php5-cli                        5.3.2-1ubuntu4.20

In general, a standard system update will make all the necessary changes.

  CVE-2013-4113, CVE-2013-4635

Package Information:

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 899 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20130716/9a088f43/attachment.sig>

More information about the ubuntu-security-announce mailing list