Security Update for php5
Summary
DSA-2943-1: php5 - security update. Affects php5 versions < 5.4.4-14+deb7u10. Fixed in 5.4.4-14+deb7u10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a general-purpose scripting language commonly used for web application development. It is widely used due to its simplicity and versatility. The php5 package is specifically targeted by this security update.
Vulnerability Detail
Several vulnerabilities have been discovered in the php5 package:
-
CVE-2014-0185: The default PHP FPM socket permission has been changed from 0666 to 0660 to mitigate a security vulnerability in PHP FPM. This vulnerability allowed any local user to run a PHP code under the active user of the FPM process via a crafted FastCGI client.
-
CVE-2014-0237 / CVE-2014-0238: Denial of service vulnerabilities in the CDF parser of the fileinfo module.
-
CVE-2014-2270: Denial of service vulnerability in the fileinfo module.
How To Fix
Minimum fixed version
5.4.4-14+deb7u10
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for these vulnerabilities.
Conclusion
It is crucial to upgrade your php5 packages to the recommended version to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for php5 →
FAQ
PHP is a general-purpose scripting language commonly used for web application development.
The php5 package is a specific version of PHP that is targeted by this security update.
CVE-2014-0185 is a security vulnerability in PHP FPM that allowed any local user to run a PHP code under the active user of the FPM process via a crafted FastCGI client.
CVE-2014-0237 / CVE-2014-0238 are denial of service vulnerabilities in the CDF parser of the fileinfo module.
CVE-2014-2270 is a denial of service vulnerability in the fileinfo module.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
