[Bug 1338170] Re: PHP 5 infoleak vulnerability leading to potential SSL key disclosure
Launchpad Bug Tracker
1338170 at bugs.launchpad.net
Wed Jul 9 15:54:48 UTC 2014
This bug was fixed in the package php5 - 5.5.9+dfsg-1ubuntu4.3
---------------
php5 (5.5.9+dfsg-1ubuntu4.3) trusty-security; urgency=medium
* SECURITY UPDATE: denial of service in FileInfo cdf_read_short_sector
- debian/patches/CVE-2014-0207.patch: properly calculate sizes in
ext/fileinfo/libmagic/cdf.c.
- CVE-2014-0207
* SECURITY UPDATE: denial of service in FileInfo mconvert
- debian/patches/CVE-2014-3478.patch: properly handle truncated pascal
string size in ext/fileinfo/libmagic/softmagic.c.
- CVE-2014-3478
* SECURITY UPDATE: denial of service in FileInfo cdf_check_stream_offset
- debian/patches/CVE-2014-3479.patch: properly calculate sizes in
ext/fileinfo/libmagic/cdf.c.
- CVE-2014-3479
* SECURITY UPDATE: denial of service in FileInfo cdf_count_chain
- debian/patches/CVE-2014-3480.patch: properly calculate sizes in
ext/fileinfo/libmagic/cdf.c.
- CVE-2014-3480
* SECURITY UPDATE: denial of service in FileInfo cdf_read_property_info
- debian/patches/CVE-2014-3487.patch: properly calculate sizes in
ext/fileinfo/libmagic/cdf.c.
- CVE-2014-3487
* SECURITY UPDATE: denial of service and possible code execution via
unserialize() SPL type confusion
- debian/patches/CVE-2014-3515.patch: properly check types in
ext/spl/spl_array.c, ext/spl/spl_observer.c, added test to
ext/spl/tests/SplObjectStorage_unserialize_bad.phpt.
- CVE-2014-3515
* SECURITY UPDATE: denial of service via SPL Iterators use-after-free
- debian/patches/CVE-2014-4670.patch: fix use-after-free in
ext/spl/spl_dllist.c, added test to ext/spl/tests/bug67538.phpt.
- CVE-2014-4670
* SECURITY UPDATE: denial of service via ArrayIterator use-after-free
- debian/patches/CVE-2014-4698.patch: don't allow modifying ArrayObject
during sorting in ext/spl/spl_array.c, added test to
ext/spl/tests/bug67539.phpt.
- CVE-2014-4698
* SECURITY UPDATE: information leak via phpinfo (LP: #1338170)
- debian/patches/CVE-2014-4721.patch: fix type confusion in
ext/standard/info.c, added test to
ext/standard/tests/general_functions/bug67498.phpt.
- CVE-2014-4721
-- Marc Deslauriers <marc.deslauriers at ubuntu.com> Mon, 07 Jul 2014 07:44:21 -0400
--
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to php5 in Ubuntu.
https://bugs.launchpad.net/bugs/1338170
Title:
PHP 5 infoleak vulnerability leading to potential SSL key disclosure
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1338170/+subscriptions
More information about the Ubuntu-server-bugs
mailing list