Security Update for php5
Summary
DLA-1034-1: php5 - security update. Affects php5 versions < 5.4.45-0+deb7u9. Fixed in 5.4.45-0+deb7u9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
php5 is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. It is commonly used to create dynamic web pages and applications. The php5 package in Debian 7 Wheezy is affected by several vulnerabilities that could be exploited by attackers to bypass URL checks, crash the PHP interpreter, disclose information, or potentially execute arbitrary code.
Vulnerability Detail
The vulnerabilities in php5 include:
-
CVE-2016-10397: Incorrect handling of various URI components in the URL parser could be used by attackers to bypass hostname-specific URL checks.
-
CVE-2017-11143: An invalid free in the WDDX deserialization of boolean parameters could be used by attackers to crash the PHP interpreter.
-
CVE-2017-11144: The openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter.
-
CVE-2017-11145: Lack of a bounds check in the date extension's timelib_meridian parsing code could be used by attackers to leak information from the interpreter.
-
CVE-2017-11147: The PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c.
How To Fix
Minimum fixed version
5.4.45-0+deb7u9
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The php5 package in Debian 7 Wheezy is affected by multiple vulnerabilities that could be exploited by attackers. To protect your system, it is recommended to upgrade the php5 package to version 5.4.45-0+deb7u9 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for php5 →
FAQ
php5 is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML.
The vulnerabilities in php5 include CVE-2016-10397, CVE-2017-11143, CVE-2017-11144, CVE-2017-11145, and CVE-2017-11147. These vulnerabilities could be exploited by attackers to bypass URL checks, crash the PHP interpreter, disclose information, or potentially execute arbitrary code.
To fix these vulnerabilities, it is recommended to upgrade the php5 package to version 5.4.45-0+deb7u9 or later. This can be done by running the package manager update command on the affected system.
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to apply the security update to fix the vulnerabilities.
You can find more information about Debian LTS security advisories, how to apply updates, and frequently asked questions at the Debian LTS wiki: https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for php5.
