Security Update for php5
Summary
DLA-533-1: php5 - security update. Affects php5 versions < 5.4.45-0+deb7u4. Fixed in 5.4.45-0+deb7u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
php5 is a popular open-source scripting language used for web development. It provides a wide range of functionality and is widely used in various applications. However, several vulnerabilities have been discovered in php5, which could potentially be exploited by attackers to compromise the security of the system.
Vulnerability Detail
The vulnerabilities in php5 include:
-
CVE-2016-5093: Absence of null character causes unexpected zend_string length and leaks heap memory. This can be triggered by various functions, including locale_get_primary_language, locale_canonicalize, locale_filter_matches, locale_lookup, and locale_parse.
-
CVE-2016-5094 and CVE-2016-5095: These vulnerabilities involve creating strings with lengths outside the int range, which can lead to unexpected behavior and potential security issues.
-
CVE-2016-5096: This vulnerability arises from an int/size_t confusion in the fread function.
-
CVE-TEMP-bug-70661: Use After Free Vulnerability in WDDX Packet Deserialization.
-
CVE-TEMP-bug-70728: Type Confusion Vulnerability in PHP_to_XMLRPC_worker().
-
CVE-TEMP-bug-70741: Session WDDX Packet Deserialization Type Confusion Vulnerability.
-
CVE-TEMP-bug-70480-raw: Buffer overflow read in php_url_parse_ex() function.
How To Fix
Minimum fixed version
5.4.45-0+deb7u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for these vulnerabilities.
Conclusion
In conclusion, php5 is affected by multiple vulnerabilities that could potentially be exploited by attackers. It is crucial to upgrade to the latest version to ensure the security of the system. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for php5 →
FAQ
php5 is an open-source scripting language used for web development. It provides a wide range of functionality and is widely used in various applications.
The vulnerabilities in php5 include absence of null character causing unexpected zend_string length and memory leaks, creating strings with lengths outside the int range, int/size_t confusion in fread, use after free vulnerability in WDDX packet deserialization, type confusion vulnerability in PHP_to_XMLRPC_worker(), and session WDDX packet deserialization type confusion vulnerability.
These vulnerabilities could potentially be exploited by attackers to compromise the security of the system, leading to unauthorized access, data breaches, and other malicious activities.
To fix these vulnerabilities, it is recommended to upgrade your php5 packages to version 5.4.45-0+deb7u4 or later. This can be done by following the instructions provided by the Debian LTS security advisories.
No specific workaround has been mentioned for these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
