[Bug 1338170] Re: PHP 5 infoleak vulnerability leading to potential SSL key disclosure
Launchpad Bug Tracker
1338170 at bugs.launchpad.net
Wed Jul 9 15:54:42 UTC 2014
This bug was fixed in the package php5 - 5.3.10-1ubuntu3.13
---------------
php5 (5.3.10-1ubuntu3.13) precise-security; urgency=medium
* SECURITY UPDATE: denial of service in FileInfo cdf_read_short_sector
- debian/patches/CVE-2014-0207.patch: properly calculate sizes in
ext/fileinfo/libmagic/cdf.c.
- CVE-2014-0207
* SECURITY UPDATE: denial of service in FileInfo cdf_count_chain
- debian/patches/CVE-2014-3480.patch: properly calculate sizes in
ext/fileinfo/libmagic/cdf.c.
- CVE-2014-3480
* SECURITY UPDATE: denial of service and possible code execution via
unserialize() SPL type confusion
- debian/patches/CVE-2014-3515.patch: properly check types in
ext/spl/spl_array.c, ext/spl/spl_observer.c, added test to
ext/spl/tests/SplObjectStorage_unserialize_bad.phpt.
- CVE-2014-3515
* SECURITY UPDATE: denial of service via SPL Iterators use-after-free
- debian/patches/CVE-2014-4670.patch: fix use-after-free in
ext/spl/spl_dllist.c, added test to ext/spl/tests/bug67538.phpt.
- CVE-2014-4670
* SECURITY UPDATE: denial of service via ArrayIterator use-after-free
- debian/patches/CVE-2014-4698.patch: don't allow modifying ArrayObject
during sorting in ext/spl/spl_array.c, added test to
ext/spl/tests/bug67539.phpt.
- CVE-2014-4698
* SECURITY UPDATE: information leak via phpinfo (LP: #1338170)
- debian/patches/CVE-2014-4721.patch: fix type confusion in
ext/standard/info.c, added test to
ext/standard/tests/general_functions/bug67498.phpt.
- CVE-2014-4721
-- Marc Deslauriers <marc.deslauriers at ubuntu.com> Mon, 07 Jul 2014 08:41:06 -0400
** Changed in: php5 (Ubuntu Precise)
Status: New => Fix Released
** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2014-0207
** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2014-3480
** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2014-3515
** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2014-4670
** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2014-4698
** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2014-4721
** Changed in: php5 (Ubuntu Trusty)
Status: New => Fix Released
** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2014-3478
** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2014-3479
** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2014-3487
--
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to php5 in Ubuntu.
https://bugs.launchpad.net/bugs/1338170
Title:
PHP 5 infoleak vulnerability leading to potential SSL key disclosure
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1338170/+subscriptions
More information about the Ubuntu-server-bugs
mailing list