SB2014082910 - Gentoo update for PHP
Published: August 29, 2014 Updated: June 28, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 25 secuirty vulnerabilities.
1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2011-4718)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack web sessions by specifying a session ID.
2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2013-1635)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory.
3) Information disclosure (CVE-ID: CVE-2013-1643)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The SOAP parser in PHP before 5.3.23 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-1824.
4) XML External Entity injection (CVE-ID: CVE-2013-1824)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.12 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.
5) Heap-based buffer overflow (CVE-ID: CVE-2013-2110)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in Heap-based buffer overflow in the php_quot_print_encode function in ext/standard/quot_print.c in PHP before 5.3.26 and 5.4.x before 5.4.16. A remote attacker can use a crafted argument to the quoted_printable_encode function. to trigger heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
6) Buffer overflow (CVE-ID: CVE-2013-4113)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xml_parse_into_struct function.
7) Man-in-the-Middle (MitM) attack (CVE-ID: CVE-2013-4248)
The vulnerability allows a remote attacker to conduct MITM-attack on the target system.The weakness exists due to the openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '' character in a domain name in the Subject Alternative Name field of an X.509 certificate. A remote attacker can use man-in-the-middle technique and spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
8) Input validation error (CVE-ID: CVE-2013-4635)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows context-dependent attackers to cause a denial of service (application hang) via a large argument to the jdtojewish function.
9) Input validation error (CVE-ID: CVE-2013-4636)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The mget function in libmagic/softmagic.c in the Fileinfo component in PHP 5.4.x before 5.4.16 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via an MP3 file that triggers incorrect MIME type detection during access to an finfo object.
10) Buffer overflow (CVE-ID: CVE-2013-6420)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when the asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates. A remote attacker can supply specially crafted X.509 certificates, trigger memory corruption and cause the service to crash or execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
11) Buffer over-read (CVE-ID: CVE-2013-6712)
The vulnerability allows a remote attacker to cause DoS condition.
The vulnerability exists due to the scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects. A remote attacker can trigger heap-based buffer over-read and cause the service to crash via a crafted interval specification.
12) Heap-based buffer overflow (CVE-ID: CVE-2013-7226)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow in the gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before 5.5.9. A remote attacker can use an imagecrop function call with a large x dimension value to trigger heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
13) NULL pointer dereference (CVE-ID: CVE-2013-7327)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error when the gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check return value. A remote attacker can trigger NULL pointer dereference via invalid imagecrop arguments and cause the service to crash.
14) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2013-7345)
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters.
15) Privilege escalation (CVE-ID: CVE-2014-0185)
The vulnerability allows a local attacker to gain elevated privileges. The weakness exists due to sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket. A local attacker can gain elevated privileges via a crafted FastCGI client.16) Denial of service (CVE-ID: CVE-2014-0237)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists in cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 due to performance degradation. A remote attacker can trigger many file_printf calls and cause the service to crash.
17) Infinite loop (CVE-ID: CVE-2014-0238)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in the cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13. A remote attacker can trigger out-of-bounds memory access via a vector that (1) has zero length or (2) is too long and cause the service to crash.
18) Resource exhaustion (CVE-ID: CVE-2014-1943)
The vulnerability allows a local attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite recursion when insufficient validation of user-supplied input. A local attacker can trigger CPU consumption and cause the service to crash.
19) Out-of-bounds read (CVE-ID: CVE-2014-2270)
The vulnerability allows a remote attacker to cause DoS condition.
The vulnerability exists due to out-of-bounds read error in softmagic.c in file before 5.17 and libmagic. A remote attacker can trigger out-of-bounds read error via crafted offsets in the softmagic of a PE executable and cause the service to crash.
20) NULL pointer dereference (CVE-ID: CVE-2014-2497)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a crafted color table in an XPM file.
21) Buffer overflow (CVE-ID: CVE-2014-3597)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16. A remote attacker can trigger memory corruption via a crafted DNS record, related to the dns_get_record function and the dn_expand function and cause the service to crash or execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
22) Link following (CVE-ID: CVE-2014-3981)
The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.
acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file.
23) Heap-based buffer overflow (CVE-ID: CVE-2014-4049)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to heap-based buffer overflow in the php_parserr function in ext/standard/dns.c. A remote attacker can trigger memory corruption via a crafted DNS TXT record, related to the dns_get_record function and cause the service to crash or execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
24) Use-after-free (CVE-ID: CVE-2014-4670)
The vulnerability allows a local attacker to cause DoS condition.
The vulnerability exists due to use-after-free error in ext/spl/spl_dllist.c in the SPL component in PHP through 5.5.14. A local attacker can trigger memory corruption via crafted iterator usage within applications in certain web-hosting environments and cause the service to crash.
25) Input validation error (CVE-ID: CVE-2014-5120)
The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.
gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function.
Remediation
Install update from vendor's website.