Red Hat Security Advisory

RHSA-2013:1615

php security, bug fix, and enhancement update

Released 2013-11-20 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop Optional (v. 6) php-5.3.3-26.el6, php-bcmath-5.3.3-26.el6, php-cli-5.3.3-26.el6 +24
Red Hat Enterprise Linux HPC Node (v. 6) php-5.3.3-26.el6, php-cli-5.3.3-26.el6, php-common-5.3.3-26.el6
Red Hat Enterprise Linux HPC Node Optional (v. 6) php-5.3.3-26.el6, php-bcmath-5.3.3-26.el6, php-dba-5.3.3-26.el6 +22
Red Hat Enterprise Linux Server (v. 6) php-5.3.3-26.el6, php-cli-5.3.3-26.el6, php-common-5.3.3-26.el6 +9
Red Hat Enterprise Linux Server Optional (v. 6) php-5.3.3-26.el6, php-bcmath-5.3.3-26.el6, php-dba-5.3.3-26.el6 +13
Red Hat Enterprise Linux Workstation (v. 6) php-5.3.3-26.el6, php-cli-5.3.3-26.el6, php-common-5.3.3-26.el6 +9
Red Hat Enterprise Linux Workstation Optional (v. 6) php-5.3.3-26.el6, php-bcmath-5.3.3-26.el6, php-dba-5.3.3-26.el6 +13

Fixes 3 records

TI-2013-01445 CVE-2013-1643 · GHSA-g625-6qfm-gm8r

The SOAP parser in PHP before 5.3.23 and 5.4.x before 5.4.13 allows remote attackers to…

LOW 35

The SOAP parser in PHP before 5.3.23 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, rel…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.10136 Published 2013-03-06 Fixed CWE-200

TI-2006-06983 CVE-2006-7243 · GHSA-qxh9-g3ww-hcvc

PHP before 5.3.4 accepts the \0 character in a pathname, which might allow…

LOW 31

PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.05363 Published 2011-01-18 Partial fix CWE-20

TI-2013-03719 CVE-2013-4248 · GHSA-hhfm-3287-cc2v

The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18…

LOW 26

The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03331 Published 2013-08-18 Partial fix CWE-20