Errata ID | 363 |
---|---|
Date | 2015-08-21 |
Source package | php5 |
Fixed in version | 5.3.3.1-7.212.201508171807 |
Description | This erratum fixes the following issues in php5: * Denial of service in CDF property info parsing (CVE-2014-0237) * Infinite loop or out-of-bounds memory access in CDF property info parsing (CVE-2014-0238) * Denial of service via crafted offsets in the softmagic of a PE executable (CVE-2014-2270) * Denial of service issues in the ELF parser of the filemagic extensions (CVE-2014-8117) * Denial of service via long pascal strings (CVE-2014-9652) * Heap buffer overflow in enchant_broker_request_dict for PHP "enchant" extension (CVE-2014-9705) * Memory corruption in processing EXIF tags (CVE-2015-0232) * Denial of Service due to use after free in phar_object.c (CVE-2015-2301) * ZIP Integer Overflow leads to writing past heap boundary (CVE-2015-2331) * Buffer Over-read in unserialize when parsing Phar (CVE-2015-2783) * Use-after-free vulnerability in the process_nested_data function allows execution of arbitrary code by remote attackers (CVE-2015-2787) * Buffer Overflow when parsing tar/zip/phar in phar_set_inode (CVE-2015-3329) * Remote code execution with apache 2.4 apache2handler (CVE-2015-3330) * Denial of service when processing a crafted file with Fileinfo (CVE-2015-4604 CVE-2015-4605) |
Additional notes | |
CVE ID | CVE-2014-0237 CVE-2014-0238 CVE-2014-2270 CVE-2014-8117 CVE-2014-9652 CVE-2014-9705 CVE-2015-0232 CVE-2015-2301 CVE-2015-2331 CVE-2015-2783 CVE-2015-2787 CVE-2015-3329 CVE-2015-3330 CVE-2015-4604 CVE-2015-4605 |
UCS Bug number | #37093 |