Security Update for php5
Summary
DSA-3380-1: php5 - security update. Affects php5 versions < 5.4.45-0+deb7u2. Fixed in 5.4.45-0+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a general-purpose scripting language commonly used for web application development. It is widely used due to its simplicity, flexibility, and extensive library support. The php5 package is a specific version of PHP that is vulnerable to two security issues.
Vulnerability Detail
The first vulnerability, identified as CVE-2015-7803, is related to the phar extension in PHP. It could crash with a NULL pointer dereference when processing tar archives containing links referring to non-existing files. This could result in a denial of service attack. The second vulnerability, CVE-2015-7804, affects the phar extension's handling of directory entries found in archive files with the name "/". This flaw could lead to a denial of service and potentially disclose sensitive information.
How To Fix
Minimum fixed version
5.4.45-0+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
Upgrading the php5 package to the fixed versions is crucial to mitigate the security risks associated with these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for php5 →
FAQ
PHP is a general-purpose scripting language used for web development.
The phar extension in PHP allows for the creation and manipulation of Phar archives, which are used for packaging PHP applications.
A NULL pointer dereference occurs when a program attempts to access memory using a null pointer, leading to a crash or unexpected behavior.
A denial of service attack aims to disrupt the availability of a system or network, making it inaccessible to legitimate users.
You can use Vulert's playground (https://vulert.com/scanner) to check if your php5 package is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will provide real-time alerts for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
