Security Update for php7.0
Summary
DSA-4403-1: php7.0 - security update. Affects php7.0 versions < 7.0.33-0+deb9u3. Fixed in 7.0.33-0+deb9u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
php7.0 is a widely-used open source general purpose scripting language. It is commonly used for web development and can be embedded into HTML. The language is known for its simplicity and flexibility, making it a popular choice among developers. However, multiple security issues have been discovered in the php7.0 package.
Vulnerability Detail
The vulnerability in php7.0 is related to the EXIF extension and the insecure implementation of the rename() function. The EXIF extension had multiple cases of invalid memory access, which could potentially lead to memory corruption and arbitrary code execution. The insecure implementation of rename() could allow an attacker to overwrite files or perform other malicious actions. These vulnerabilities pose a risk to systems running php7.0, as they could be exploited by attackers to gain unauthorized access or execute arbitrary code.
How To Fix
Minimum fixed version
7.0.33-0+deb9u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the php7.0 package has multiple security vulnerabilities related to the EXIF extension and the rename() function. It is important to upgrade to the latest version of the package to mitigate these vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for php7.0 →
FAQ
php7.0 is a popular open source scripting language used for web development.
The vulnerability could allow attackers to execute arbitrary code or gain unauthorized access to systems running php7.0.
To fix the vulnerability, upgrade the php7.0 package to version 7.0.33-0+deb9u3 or later.
No specific workarounds have been mentioned for this vulnerability.
More information about the vulnerability can be found on the security tracker page for php7.0.
Related vulnerabilities
Recent vulnerabilities recorded for php7.0.
