Home / mailings

PDF

[SECURITY] [DSA 3195-1] php5 security update

Posted on 18 March 2015
Debian Security Advisory

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3195-1 security@debian.org
http://www.debian.org/security/ Moritz Muehlenhoff
March 18, 2015 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : php5
CVE ID : CVE-2014-9705 CVE-2015-0231 CVE-2015-0232 CVE-2015-0273
CVE-2015-2305

Multiple vulnerabilities have been discovered in the PHP language:

CVE-2015-2305

Guido Vranken discovered a heap overflow in the ereg extension
(only applicable to 32 bit systems).

CVE-2014-9705

Buffer overflow in the enchant extension.

CVE-2015-0231

Stefan Esser discovered a use-after-free in the unserialisation
of objects.

CVE-2015-0232

Alex Eubanks discovered incorrect memory management in the exif
extension.

CVE-2015-0273

Use-after-free in the unserialisation of DateTimeZone.

For the stable distribution (wheezy), these problems have been fixed in
version 5.4.38-0+deb7u1.

For the upcoming stable distribution (jessie), these problems have been
fixed in version 5.6.6+dfsg-2.

For the unstable distribution (sid), these problems have been fixed in
version 5.6.6+dfsg-2.

We recommend that you upgrade your php5 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org

 

TOP