Security Update for php5
Summary
DSA-3280-1: php5 - security update. Affects php5 versions < 5.4.41-0+deb7u1. Fixed in 5.4.41-0+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
php5 is a popular open-source scripting language used for web development. It is widely used for creating dynamic web pages and applications. The vulnerability in php5 allows attackers to exploit various functions and cause denial of service or potentially execute arbitrary code.
Vulnerability Detail
Multiple vulnerabilities have been discovered in PHP. These include:
- CVE-2015-4025 / CVE-2015-4026: Multiple functions didn't check for NULL bytes in path names, which could be exploited by attackers.
- CVE-2015-4024: Denial of service vulnerability when processing multipart/form-data requests.
- CVE-2015-4022: Integer overflow in the ftp_genlist() function may result in denial of service or potentially the execution of arbitrary code.
- CVE-2015-4021 / CVE-2015-3329 / CVE-2015-2783: Multiple vulnerabilities in the phar extension may result in denial of service or potentially the execution of arbitrary code when processing malformed archives.
How To Fix
Minimum fixed version
5.4.41-0+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
It is crucial to update your php5 packages to the recommended versions to mitigate the vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for php5 →
FAQ
php5 is a popular open-source scripting language used for web development. It is widely used for creating dynamic web pages and applications.
The vulnerabilities in php5 include functions not checking for NULL bytes in path names, denial of service when processing multipart/form-data requests, integer overflow in the ftp_genlist() function, and vulnerabilities in the phar extension when processing malformed archives.
These vulnerabilities can be exploited by attackers to cause denial of service or potentially execute arbitrary code.
To fix these vulnerabilities, it is recommended to upgrade your php5 packages to the specified versions.
You can find more information about these vulnerabilities in the provided CVE links.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
