Security Update for php5
Summary
DSA-3344-1: php5 - security update. Affects php5 versions < 5.4.44-0+deb7u1. Fixed in 5.4.44-0+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
php5 is a popular programming language used for web development. It is widely used for creating dynamic web pages and applications. The vulnerability described in this report affects the php5 package, specifically versions 5.4.44-0+deb7u1 and 5.6.12+dfsg-0+deb8u1 on Debian 7 and Debian 8 respectively.
Vulnerability Detail
Multiple vulnerabilities have been discovered in the PHP language. These include:
-
CVE-2015-4598: A flaw that allows an attacker to manipulate unexpected files on the server by exploiting paths containing a NUL character.
-
CVE-2015-4643: An integer overflow flaw in PHP's FTP extension that can lead to a heap-based buffer overflow, potentially resulting in a crash or execution of arbitrary code.
-
CVE-2015-4644: A denial of service vulnerability caused by a segfault in the php_pgsql_meta_data function.
-
CVE-2015-5589: A vulnerability that can cause PHP to crash when processing an invalid phar file, leading to a denial of service.
-
CVE-2015-5590: A buffer overflow in the phar_fix_filepath function that can cause a crash or execution of arbitrary code.
In addition to these, several other vulnerabilities were fixed, including problems with unserialization, handling of zip archives with relative paths, and use-after-free vulnerabilities.
How To Fix
Minimum fixed version
5.4.44-0+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Upgrading the php5 package to the fixed versions is crucial to ensure the security of your web applications and prevent potential attacks. It is recommended to follow the provided steps to upgrade the package and restart any dependent services. For further assistance or support, you can contact DevNack.com.
See every vulnerability recorded for php5 →
FAQ
These vulnerabilities can have various impacts, including arbitrary code execution, denial of service, and unauthorized access to files on the server.
No, only versions 5.4.44-0+deb7u1 and 5.6.12+dfsg-0+deb8u1 on Debian 7 and Debian 8 respectively are affected. Other versions may have different vulnerabilities.
No specific workaround has been mentioned for these vulnerabilities. It is recommended to upgrade to the fixed versions of php5.
Yes, these vulnerabilities can be exploited remotely if the affected server is accessible over the network.
You can find more information about these vulnerabilities in the Debian Security Advisory DSA-3344-1.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
