Updated php53 and php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. PHP's fileinfo module provides functions used to identify a particular file according to the type of data contained by the file.

Multiple denial of service flaws were found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash a PHP application using fileinfo via a specially crafted CDF file. (CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2012-1571)

Two denial of service flaws were found in the way the File Information (fileinfo) extension handled indirect and search rules. A remote attacker could use either of these flaws to cause a PHP application using fileinfo to crash or consume an excessive amount of CPU.
(CVE-2014-1943, CVE-2014-2270)

A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT records. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query. (CVE-2014-4049)

A type confusion issue was found in PHP's phpinfo() function. A malicious script author could possibly use this flaw to disclose certain portions of server memory. (CVE-2014-4721)

A buffer over-read flaw was found in the way the DateInterval class parsed interval specifications. An attacker able to make a PHP application parse a specially crafted specification using DateInterval could possibly cause the PHP interpreter to crash. (CVE-2013-6712)

A type confusion issue was found in the SPL ArrayObject and SPLObjectStorage classes' unserialize() method. A remote attacker able to submit specially crafted input to a PHP application, which would then unserialize this input using one of the aforementioned methods, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application. (CVE-2014-3515)

The CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, and CVE-2014-3480 issues were discovered by Francisco Alonso of Red Hat Product Security.

All php53 and php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

Multiple denial of service flaws were found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash a PHP application using fileinfo via a specially crafted CDF file. (CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2012-1571)

Two denial of service flaws were found in the way the File Information (fileinfo) extension handled indirect and search rules. A remote attacker could use either of these flaws to cause a PHP application using fileinfo to crash or consume an excessive amount of CPU.
(CVE-2014-1943, CVE-2014-2270)

A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT records. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query. (CVE-2014-4049)

A type confusion issue was found in PHP's phpinfo() function. A malicious script author could possibly use this flaw to disclose certain portions of server memory. (CVE-2014-4721)

A buffer over-read flaw was found in the way the DateInterval class parsed interval specifications. An attacker able to make a PHP application parse a specially crafted specification using DateInterval could possibly cause the PHP interpreter to crash. (CVE-2013-6712)

A type confusion issue was found in the SPL ArrayObject and SPLObjectStorage classes' unserialize() method. A remote attacker able to submit specially crafted input to a PHP application, which would then unserialize this input using one of the aforementioned methods, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application. (CVE-2014-3515)

This update fixes the following security issues with php, php5 and php53 :

  - bnc#884986, CVE-2014-0207: file: php5:
    cdf_read_short_sector insufficient boundary check 

  - bnc#884987, CVE-2014-3478: file: mconvert incorrect     handling of truncated pascal string size 

  - bnc#884989, CVE-2014-3479: php53: file:
    cdf_check_stream_offset insufficient boundary check 

  - bnc#884990, CVE-2014-3480: php53: file: cdf_count_chain     insufficient boundary check 

  - bnc#884991, CVE-2014-3487: php53: file:
    cdf_read_property_info insufficient boundary check 

  - bnc#884992, CVE-2014-3515: php5: unserialize() SPL     ArrayObject / SPLObjectStorage Type Confusion

PHP 5.3 has been updated to fix several security problems :

  - The SPL component in PHP incorrectly anticipated that     certain data structures will have the array data type     after unserialization, which allowed remote attackers to     execute arbitrary code via a crafted string that     triggers use of a Hashtable destructor, related to 'type     confusion' issues in (1) ArrayObject and (2)     SPLObjectStorage. (CVE-2014-3515)

  - The cdf_read_short_sector function in cdf.c in file     before 5.19, as used in the Fileinfo component in PHP     allowed remote attackers to cause a denial of service     (assertion failure and application exit) via a crafted     CDF file. (CVE-2014-0207)

  - Buffer overflow in the mconvert function in softmagic.c     in file before 5.19, as used in the Fileinfo component     in PHP allowed remote attackers to cause a denial of     service (application crash) via a crafted Pascal string     in a FILE_PSTRING conversion. (CVE-2014-3478)

  - The cdf_check_stream_offset function in cdf.c in file     before 5.19, as used in the Fileinfo component in PHP     relied on incorrect sector-size data, which allowed     remote attackers to cause a denial of service     (application crash) via a crafted stream offset in a CDF     file. (CVE-2014-3479)

  - The cdf_count_chain function in cdf.c in file before     5.19, as used in the Fileinfo component in PHP did not     properly validate sector-count data, which allowed     remote attackers to cause a denial of service     (application crash) via a crafted CDF file.
    (CVE-2014-3480)

  - The cdf_read_property_info function in file before 5.19,     as used in the Fileinfo component in PHP did not     properly validate a stream offset, which allowed remote     attackers to cause a denial of service (application     crash) via a crafted CDF file. (CVE-2014-3487)

  - Use-after-free vulnerability in ext/spl/spl_dllist.c in     the SPL component in PHP allowed context-dependent     attackers to cause a denial of service or possibly have     unspecified other impact via crafted iterator usage     within applications in certain web-hosting environments.
    (CVE-2014-4670)

  - Use-after-free vulnerability in ext/spl/spl_array.c in     the SPL component in PHP allowed context-dependent     attackers to cause a denial of service or possibly have     unspecified other impact via crafted ArrayIterator usage     within applications in certain web-hosting environments.
    (CVE-2014-4698)

  - The phpinfo implementation in ext/standard/info.c in PHP     did not ensure use of the string data type for the     PHP_AUTH_PW, PHP_AUTH_TYPE, PHP_AUTH_USER, and PHP_SELF     variables, which might allow context-dependent attackers     to obtain sensitive information from process memory by     using the integer data type with crafted values, related     to a 'type confusion' vulnerability, as demonstrated by     reading a private SSL key in an Apache HTTP Server     web-hosting environment with mod_ssl and a PHP 5.3.x     mod_php. (CVE-2014-4721)

A denial of service flaw was found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file.

acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file.

A buffer over-read flaw was found in the way the DateInterval class parsed interval specifications. An attacker able to make a PHP application parse a specially crafted specification using DateInterval could possibly cause the PHP interpreter to crash.

A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT records. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query.

A type confusion issue was found in the SPL ArrayObject and SPLObjectStorage classes' unserialize() method. A remote attacker able to submit specially crafted input to a PHP application, which would then unserialize this input using one of the aforementioned methods, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application.

New php packages are available for Slackware 14.0, 14.1, and -current to fix security issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
77015	RHEL 5 / 6 : php53 and php (RHSA-2014:1012)	Nessus	Red Hat Local Security Checks	2014/8/6	2021/1/14	high
77032	CentOS 5 / 6 : php / php53 (CESA-2014:1012)	Nessus	CentOS Local Security Checks	2014/8/7	2021/1/4	high
77047	Scientific Linux Security Update : php53 and php on SL5.x, SL6.x i386/x86_64 (20140806)	Nessus	Scientific Linux Local Security Checks	2014/8/7	2021/1/14	high
76722	openSUSE Security Update : php / php5 / php53 (openSUSE-SU-2014:0925-1)	Nessus	SuSE Local Security Checks	2014/7/24	2021/1/19	high
76909	SuSE 11.3 Security Update : PHP 5.3 (SAT Patch Number 9537)	Nessus	SuSE Local Security Checks	2014/7/30	2021/1/19	high
78336	Amazon Linux AMI : php (ALAS-2014-393)	Nessus	Amazon Linux Local Security Checks	2014/10/12	2018/4/18	high
76476	Slackware 14.0 / 14.1 / current : php (SSA:2014-192-01)	Nessus	Slackware Local Security Checks	2014/7/14	2021/1/14	high

検出

プラグインの検索

high

high

high

high

high

high

high