Arch Linux Security Advisory ASA-201504-14 ========================================== Severity: High Date : 2015-04-17 CVE-ID : CVE-2015-1351 CVE-2015-1352 CVE-2015-2783 Package : php Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package php before version 5.6.8-1 is vulnerable to denial of service and information disclosure. Resolution ========== Upgrade to 5.6.8-1. # pacman -Syu "php>=5.6.8-1" The problems have been fixed upstream in version 5.6.8. Workaround ========== None. Description =========== - CVE-2015-1351 (denial of service) Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. - CVE-2015-1352 (denial of service) The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension does not validate token extraction for table names, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name. - CVE-2015-2783 (out-of-bounds read) The vulnerability can be triggered when parsing a PHAR file at phar.c:623. The "buf_len" is obtained from the phar file and passed into php_var_unserialize() as the max argument. Under normal php_var_unserialize() circumstances, YYCURSOR will always be <= max. This however can be bypassed when processing a malform phar with a buf_len that is shorter then the string to be unserialized resulting in a memory info leak. Impact ====== A remote attacker is able to perform denial of service attacks via multiple vectors or use a crafted PHAR file to read beyond a buffer resulting in information disclosure. References ========== https://php.net/ChangeLog-5.php#5.6.8 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1351 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1352 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2783 https://bugs.php.net/bug.php?id=68677 https://bugs.php.net/bug.php?id=68741 https://bugs.php.net/bug.php?id=69324