DSA-3074-1: php5 - security update
Summary
DSA-3074-1: php5 - security update. Affects php5 versions < 5.4.35-0+deb7u1. Fixed in 5.4.35-0+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a general-purpose scripting language widely used for web development. It is embedded in various applications and provides a range of functionality for creating dynamic web pages. The php5 package is specifically designed for Debian 7 (Wheezy) and includes the PHP interpreter and related modules. This package is vulnerable to a denial of service (DoS) attack due to a flaw in the file utility, which is embedded in PHP. The flaw allows attackers to cause an out-of-bounds read and application crash by supplying a specially crafted ELF file.
Vulnerability Detail
The vulnerability in the php5 package arises from the incorrect checking of note headers when processing ELF files. This flaw can be exploited by supplying a specially crafted ELF file, leading to a DoS condition. An attacker can trigger an out-of-bounds read, causing the application to crash. The impact of this vulnerability is limited to the availability of the affected application and does not allow for remote code execution or privilege escalation.
How To Fix
Minimum fixed version
5.4.35-0+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to apply the recommended fix by upgrading the php5 package to the latest version.
Conclusion
The php5 package in Debian 7 (Wheezy) is vulnerable to a denial of service (DoS) attack due to a flaw in the file utility. To mitigate this vulnerability, it is recommended to upgrade the php5 package to version 5.4.35-0+deb7u1 or later. This will ensure that the vulnerable code is replaced with a patched version, eliminating the risk of a DoS attack. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for php5 →
FAQ
The vulnerability allows attackers to cause a denial of service (DoS) by supplying a specially crafted ELF file, leading to an out-of-bounds read and application crash. However, it does not enable remote code execution or privilege escalation.
The vulnerability affects the php5 package in Debian 7 (Wheezy) before version 5.4.35-0+deb7u1.
No, there are no known workarounds for this vulnerability. It is crucial to upgrade the php5 package to the latest version.
No, this vulnerability does not allow for remote exploitation. An attacker needs to supply a specially crafted ELF file directly to the affected application.
For more information about the upstream changes, please refer to the upstream changelog for PHP version 5.4.35.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
