Security Update for php5
Summary
DSA-3117-1: php5 - security update. Affects php5 versions < 5.4.36-0+deb7u1. Fixed in 5.4.36-0+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely used general-purpose scripting language for web application development. It is commonly used to create dynamic web pages and can be embedded into HTML. The php5 package is specifically designed for Debian 7 (Wheezy) and is used to install PHP version 5.4.x. This package is vulnerable to several security issues.
Vulnerability Detail
Multiple vulnerabilities have been discovered in the php5 package. These vulnerabilities could potentially allow attackers to execute arbitrary code, crash the php5-cgi process, or cause compatibility issues with PostgreSQL 9.1 when using php5-pgsql. The vulnerabilities have been addressed by upgrading PHP to version 5.4.36, which includes bug fixes, new features, and possible incompatible changes.
How To Fix
Minimum fixed version
5.4.36-0+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Upgrading the php5 package to version 5.4.36-0+deb7u1 is crucial to address the multiple vulnerabilities discovered in the package. This upgrade includes bug fixes, new features, and possible incompatible changes. It is recommended to follow the provided steps to fix the vulnerabilities and ensure the security of your system. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for php5 →
FAQ
PHP is a general-purpose scripting language commonly used for web application development. It allows developers to create dynamic web pages and can be embedded into HTML.
The php5 package is specifically designed for Debian 7 (Wheezy) and is used to install PHP version 5.4.x. It provides the necessary files and libraries to run PHP scripts on a web server.
These vulnerabilities could allow attackers to execute arbitrary code on a vulnerable system, crash the php5-cgi process, or cause compatibility issues with PostgreSQL 9.1 when using php5-pgsql. This could lead to unauthorized access, data loss, or service disruption.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package manifest file (e.g., package-lock.json) and Vulert will analyze it for any open-source vulnerabilities.
No specific workaround has been provided for these vulnerabilities. It is recommended to upgrade the php5 package to the fixed version as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
