Red Hat Security AdvisoryRHSA-2016:2598
php security and bug fix update
Released 2016-11-03 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client Optional (v. 7) php-5.4.16-42.el7, php-bcmath-5.4.16-42.el7, php-cli-5.4.16-42.el7 +22
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) php-5.4.16-42.el7, php-bcmath-5.4.16-42.el7, php-cli-5.4.16-42.el7 +22
- Red Hat Enterprise Linux Server (v. 7) php-5.4.16-42.el7, php-cli-5.4.16-42.el7, php-common-5.4.16-42.el7 +11
- Red Hat Enterprise Linux Server Optional (v. 7) php-bcmath-5.4.16-42.el7, php-dba-5.4.16-42.el7, php-devel-5.4.16-42.el7 +8
- Red Hat Enterprise Linux Workstation (v. 7) php-5.4.16-42.el7, php-cli-5.4.16-42.el7, php-common-5.4.16-42.el7 +11
- Red Hat Enterprise Linux Workstation Optional (v. 7) php-bcmath-5.4.16-42.el7, php-dba-5.4.16-42.el7, php-devel-5.4.16-42.el7 +8
Fixes 4 records
Priority MEDIUM 54
Double free vulnerability in the _php_mb_regex_ereg_replace_exec function in php_mbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbi…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0963 · Published 2016-08-07 · Partial fix CWE-415
Priority MEDIUM 48
Integer overflow in the gdImageCreate function in gd.c in the GD Graphics Library (aka libgd) before 2.0.34RC1, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a…
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.0666 · Published 2016-08-07 · Partial fix CWE-190
Priority MEDIUM 48
Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a…
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.07495 · Published 2016-08-07 · Partial fix CWE-190
Priority MEDIUM 46
The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted bz2…
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.09844 · Published 2017-04-21 · Partial fix CWE-787
THREATIST.IORead the docs