SB2015021209 - Ubuntu update for php5
Published: February 12, 2015 Updated: October 30, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2007-3996)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Multiple integer overflows in libgd in PHP before 5.2.4 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large (1) srcW or (2) srcH value to the (a) gdImageCopyResized function, or a large (3) sy (height) or (4) sx (width) value to the (b) gdImageCreate or the (c) gdImageCreateTrueColor function.
2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2007-5900)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
PHP before 5.2.5 allows local users to bypass protection mechanisms configured through php_admin_value or php_admin_flag in httpd.conf by using ini_set to modify arbitrary configuration variables, a different issue than CVE-2006-4625.
3) Input validation error (CVE-ID: CVE-2008-3658)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: []
The vulnerability allows context-dependent attackers to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.
4) Input validation error (CVE-ID: CVE-2008-3659)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: []
The vulnerability allows context-dependent attackers to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (crash) and possibly execute arbitrary code via the delimiter argument to the explode function. NOTE: the scope of this issue is limited since most applications would not use an attacker-controlled delimiter, but local attacks against safe_mode are feasible.
5) Input validation error (CVE-ID: CVE-2008-3660)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: []
The vulnerability allows remote attackers to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (crash) via a request with multiple dots preceding the extension, as demonstrated using foo.php.
6) Heap-based buffer overflow (CVE-ID: CVE-2008-5557)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: []
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in Heap-based buffer overflow in ext/mbstring/libmbfl/filters/mbfilter_htmlent.c in the mbstring extension in PHP 4.3.0 through 5.2.6. A remote attacker can use a crafted string containing an HTML entity to trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
7) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2008-5624)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
PHP 5 before 5.2.7 does not properly initialize the page_uid and page_gid global variables for use by the SAPI php_getuid function, which allows context-dependent attackers to bypass safe_mode restrictions via variable settings that are intended to be restricted to root, as demonstrated by a setting of /etc for the error_log variable.
8) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2008-5625)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
PHP 5 before 5.2.7 does not enforce the error_log safe_mode restrictions when safe_mode is enabled through a php_admin_flag setting in httpd.conf, which allows context-dependent attackers to write to arbitrary files by placing a "php_value error_log" entry in a .htaccess file.
9) Path traversal (CVE-ID: CVE-2008-5658)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: []
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences in the ZipArchive::extractTo function in PHP 5.2.6 and earlier. A remote authenticated attacker can send a specially crafted HTTP request and context-dependent attackers to write arbitrary files via a ZIP file with a file whose name contains . (dot dot) sequences.
Remediation
Install update from vendor's website.