Security Update for php5
Summary
DLA-875-1: php5 - security update. Affects php5 versions < 5.4.45-0+deb7u8. Fixed in 5.4.45-0+deb7u8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
php5 is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML. It is commonly used to build dynamic websites and applications.
Vulnerability Detail
The security update addresses several vulnerabilities in php5:
-
CVE-2016-7478: This vulnerability allows remote attackers to cause a denial of service (infinite loop) by sending a crafted Exception object in serialized data.
-
CVE-2016-7479: During the unserialization process, resizing the properties hash table of a serialized object may lead to use-after-free, allowing a remote attacker to execute arbitrary code.
-
CVE-2017-7272: The fsockopen() function in php5 uses the port number defined in the hostname instead of the port number passed as a parameter. This can introduce a new attack vector for known vulnerabilities like Server Side Request Forgery (SSRF).
How To Fix
Minimum fixed version
5.4.45-0+deb7u8
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities.
Conclusion
It is crucial to keep your php5 packages up to date to protect against these vulnerabilities. Upgrade to version 5.4.45-0+deb7u8 or later to ensure the security of your web applications and prevent potential attacks.
See every vulnerability recorded for php5 →
FAQ
php5 is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML.
CVE-2016-7478 is a vulnerability in php5 that allows remote attackers to cause a denial of service (infinite loop) by sending a crafted Exception object in serialized data.
CVE-2016-7479 is a vulnerability in php5 that allows a remote attacker to execute arbitrary code by exploiting a use-after-free issue during the unserialization process.
CVE-2017-7272 is a vulnerability in php5 that can introduce a new attack vector for known vulnerabilities like Server Side Request Forgery (SSRF) by misbehaving the fsockopen() function.
To fix these vulnerabilities, it is recommended to upgrade your php5 packages to version 5.4.45-0+deb7u8 or later. You can do this by running the package manager update command specific to your operating system.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
