Executive Summary

Summary
Title PHP vulnerabilities
Informations
Name USN-3566-2 First vendor Publication 2019-05-22
Vendor Ubuntu Last vendor Modification 2019-05-22
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 ESM - Ubuntu 12.04 ESM

Summary:

Several security issues were fixed in PHP.

Software Description: - php5: HTML-embedded scripting language interpreter

Details:

USN-3566-1 fixed several vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

It was discovered that PHP incorrectly handled certain files. An attacker could possibly use this issue to access sensitive information. (CVE-2018-20783)

It was discovered that PHP incorrectly handled certain files. An attacker could possibly use this issue to access sensitive information or possibly cause a crash, resulting in a denial of service.テつ (CVE-2019-11036)

Original advisory details:

テつ It was discovered that PHP incorrectly handled memory when テつ unserializing certain data. A remote attacker could use this issue to テつ cause PHP to crash, resulting in a denial of service, or possibly テつ execute arbitrary code. This issue only affected Ubuntu 12.04 ESM. テつ (CVE-2017-12933)

テつ It was discovered that PHP incorrectly handled locale length. A remote テつ attacker could possibly use this issue to cause PHP to crash, テつ resulting in a denial of service. This issue only affected Ubuntu テつ 12.04 ESM. (CVE-2017-11362)

テつ It was discovered that PHP incorrectly handled certain stream テつ metadata. A remote attacker could possibly use this issue to set テつ arbitrary metadata. This issue only affected Ubuntu 12.04 ESM. テつ (CVE-2016-10712)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.04 ESM: テつ libapache2-mod-php5テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ 5.5.9+dfsg-1ubuntu4.29+esm2 テつ php5-cgiテつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ 5.5.9+dfsg-1ubuntu4.29+esm2 テつ php5-cliテつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ 5.5.9+dfsg-1ubuntu4.29+esm2 テつ php5-fpmテつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ 5.5.9+dfsg-1ubuntu4.29+esm2

Ubuntu 12.04 ESM: テつ libapache2-mod-php5テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ 5.3.10-1ubuntu3.36 テつ php5-cgiテつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ 5.3.10-1ubuntu3.36 テつ php5-cliテつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ 5.3.10-1ubuntu3.36 テつ php5-fpmテつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ テつ 5.3.10-1ubuntu3.36

In general, a standard system update will make all the necessary changes.

References: テつ https://usn.ubuntu.com/usn/usn-3566-2 テつ https://usn.ubuntu.com/usn/usn-3566-1 テつ CVE-2016-10712, CVE-2017-11362, CVE-2017-12933, CVE-2018-20783, テつ CVE-2019-11036

Original Source

Url : http://www.ubuntu.com/usn/USN-3566-2

CWE : Common Weakness Enumeration

% Id Name
60 % CWE-125 Out-of-bounds Read
20 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer
20 % CWE-20 Improper Input Validation

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 886
Application 1
Os 8
Os 3
Os 3
Os 3

Nessusツョ Vulnerability Scanner

Date Description
2018-05-02 Name : The remote EulerOS host is missing multiple security updates.
File : EulerOS_SA-2018-1096.nasl - Type : ACT_GATHER_INFO
2018-05-02 Name : The remote EulerOS host is missing multiple security updates.
File : EulerOS_SA-2018-1097.nasl - Type : ACT_GATHER_INFO
2018-01-09 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-4080.nasl - Type : ACT_GATHER_INFO
2018-01-09 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-4081.nasl - Type : ACT_GATHER_INFO
2017-09-25 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201709-21.nasl - Type : ACT_GATHER_INFO
2017-09-22 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2017-1079.nasl - Type : ACT_GATHER_INFO
2017-09-19 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2017-2522-1.nasl - Type : ACT_GATHER_INFO
2017-09-18 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2017-1061.nasl - Type : ACT_GATHER_INFO
2017-08-31 Name : The remote Debian host is missing a security update.
File : debian_DLA-1076.nasl - Type : ACT_GATHER_INFO
2017-08-11 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-3382-1.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2019-05-22 17:18:46
  • First insertion