[arch-security] [ASA-201504-14] php: multiple issues

[Levente Polyak]

Arch Linux Security Advisory ASA-201504-14
==========================================

Severity: High
Date    : 2015-04-17
CVE-ID  : CVE-2015-1351 CVE-2015-1352 CVE-2015-2783
Package : php
Type    : multiple issues
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package php before version 5.6.8-1 is vulnerable to denial of
service and information disclosure.

Resolution
==========

Upgrade to 5.6.8-1.

# pacman -Syu "php>=5.6.8-1"

The problems have been fixed upstream in version 5.6.8.

Workaround
==========

None.

Description
===========

- CVE-2015-1351 (denial of service)

Use-after-free vulnerability in the _zend_shared_memdup function in
zend_shared_alloc.c in the OPcache extension allows remote attackers to
cause a denial of service or possibly have unspecified other impact via
unknown vectors.

- CVE-2015-1352 (denial of service)

The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql)
extension does not validate token extraction for table names, which
allows remote attackers to cause a denial of service (NULL pointer
dereference and application crash) via a crafted name.

- CVE-2015-2783 (out-of-bounds read)

The vulnerability can be triggered when parsing a PHAR file at
phar.c:623. The "buf_len" is obtained from the phar file and passed into
php_var_unserialize() as the max argument. Under normal
php_var_unserialize() circumstances, YYCURSOR will always be <= max.
This however can be bypassed when processing a malform phar with a
buf_len that is shorter then the string to be unserialized resulting in
a memory info leak.

Impact
======

A remote attacker is able to perform denial of service attacks via
multiple vectors or use a crafted PHAR file to read beyond a buffer
resulting in information disclosure.

References
==========

https://php.net/ChangeLog-5.php#5.6.8
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1351
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1352
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2783
https://bugs.php.net/bug.php?id=68677
https://bugs.php.net/bug.php?id=68741
https://bugs.php.net/bug.php?id=69324

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20150417/fb93bc4a/attachment.asc>