Red Hat Security AdvisoryRHSA-2014:1767
php security update
Released 2014-10-30 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client Optional (v. 7) php-5.4.16-23.el7_0.3, php-bcmath-5.4.16-23.el7_0.3, php-cli-5.4.16-23.el7_0.3 +22
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) php-5.4.16-23.el7_0.3, php-bcmath-5.4.16-23.el7_0.3, php-cli-5.4.16-23.el7_0.3 +22
- Red Hat Enterprise Linux Desktop Optional (v. 6) php-5.3.3-40.el6_6, php-bcmath-5.3.3-40.el6_6, php-cli-5.3.3-40.el6_6 +24
- Red Hat Enterprise Linux HPC Node (v. 6) php-5.3.3-40.el6_6, php-cli-5.3.3-40.el6_6, php-common-5.3.3-40.el6_6
- Red Hat Enterprise Linux HPC Node Optional (v. 6) php-5.3.3-40.el6_6, php-bcmath-5.3.3-40.el6_6, php-dba-5.3.3-40.el6_6 +22
- Red Hat Enterprise Linux Server (v. 6) php-5.3.3-40.el6_6, php-cli-5.3.3-40.el6_6, php-common-5.3.3-40.el6_6 +9
- Red Hat Enterprise Linux Server (v. 7) php-5.4.16-23.el7_0.3, php-cli-5.4.16-23.el7_0.3, php-common-5.4.16-23.el7_0.3 +11
- Red Hat Enterprise Linux Server Optional (v. 6) php-bcmath-5.3.3-40.el6_6, php-dba-5.3.3-40.el6_6, php-devel-5.3.3-40.el6_6 +12
- Red Hat Enterprise Linux Server Optional (v. 7) php-bcmath-5.4.16-23.el7_0.3, php-dba-5.4.16-23.el7_0.3, php-devel-5.4.16-23.el7_0.3 +8
- Red Hat Enterprise Linux Workstation (v. 6) php-5.3.3-40.el6_6, php-cli-5.3.3-40.el6_6, php-common-5.3.3-40.el6_6 +9
- Red Hat Enterprise Linux Workstation (v. 7) php-5.4.16-23.el7_0.3, php-cli-5.4.16-23.el7_0.3, php-common-5.4.16-23.el7_0.3 +11
- Red Hat Enterprise Linux Workstation Optional (v. 6) php-bcmath-5.3.3-40.el6_6, php-dba-5.3.3-40.el6_6, php-devel-5.3.3-40.el6_6 +12
- Red Hat Enterprise Linux Workstation Optional (v. 7) php-bcmath-5.4.16-23.el7_0.3, php-dba-5.4.16-23.el7_0.3, php-devel-5.4.16-23.el7_0.3 +8
Fixes 4 records
Priority MEDIUM 56
Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash)…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.28862 · Published 2014-10-29 · Fixed CWE-189
Priority MEDIUM 50
The exif_ifd_make_value function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 operates on floating-point arrays incorrectly, which allows remote attackers to cause a d…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.22633 · Published 2014-10-29 · Fixed CWE-119
Priority MEDIUM 45
Buffer overflow in the date_from_ISO8601 function in the mkgmtime implementation in libxmlrpc/xmlrpc.c in the XMLRPC extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.27018 · Published 2014-10-29 · Fixed CWE-119
Priority LOW 38
The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure that sufficient note headers are present, which allows remote attackers to cause a denial of service…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.14013 · Published 2014-11-05 · Partial fix CWE-20
THREATIST.IORead the docs