Ubuntu update for PHP



Published: 2017-12-18 | Updated: 2018-11-28
Risk High
Patch available YES
Number of vulnerabilities 11
CVE-ID CVE-2016-10397
CVE-2017-11143
CVE-2017-11144
CVE-2017-11145
CVE-2017-11147
CVE-2017-11628
CVE-2017-9224
CVE-2017-9226
CVE-2017-9227
CVE-2017-9228
CVE-2017-9229
CWE-ID CWE-20
CWE-502
CWE-284
CWE-125
CWE-126
CWE-121
CWE-787
CWE-476
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
php5 (Ubuntu package)
Operating systems & Components / Operating system package or component

Vendor Canonical Ltd.

Security Bulletin

This security bulletin contains information about 11 vulnerabilities.

1) Security restrictions bypass

EUVDB-ID: #VU9694

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2016-10397

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to incorrect handling of various URI components in the URL parse. A remote attacker can supply specially crafted URI components and bypass hostname-specific URL checks.

Mitigation

Install updates from vendor's website:

Vulnerable software versions

php5 (Ubuntu package): 5.3.10-1ubuntu3 - 5.3.10-1ubuntu3.26


CPE2.3 External links

http://www.ubuntu.com/usn/usn-3382-2/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Deserialization of untrusted data

EUVDB-ID: #VU9695

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2017-11143

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in parser.c function due to deserialization of untrusted data. A remote attacker can inject specially crafted XML file and crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Install updates from vendor's website:

Vulnerable software versions

php5 (Ubuntu package): 5.3.10-1ubuntu3 - 5.3.10-1ubuntu3.26


CPE2.3 External links

http://www.ubuntu.com/usn/usn-3382-2/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Denial of service

EUVDB-ID: #VU9716

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2017-11144

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function. A remote attacker can trigger a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Install updates from vendor's website:

Vulnerable software versions

php5 (Ubuntu package): 5.3.10-1ubuntu3 - 5.3.10-1ubuntu3.26


CPE2.3 External links

http://www.ubuntu.com/usn/usn-3382-2/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

4) Out-of-bounds read

EUVDB-ID: #VU8965

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2017-11145

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to out-of-bounds read in timelib_meridian(). A remote attacker can read arbitrary data on the target system.

Mitigation

Install updates from vendor's website:

Vulnerable software versions

php5 (Ubuntu package): 5.3.10-1ubuntu3 - 5.3.10-1ubuntu3.26


CPE2.3 External links

http://www.ubuntu.com/usn/usn-3382-2/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

5) Buffer over-read

EUVDB-ID: #VU9717

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2017-11147

CWE-ID: CWE-126 - Buffer over-read

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition or obtain potentially sensitive information on the target system.

The weakness exists due to a flaw in the PHAR archive handler. A remote attacker can supply malicious archive files, trigger buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c and cause the PHP interpreter to crash or potentially disclose information.

Mitigation

Install updates from vendor's website:

Vulnerable software versions

php5 (Ubuntu package): 5.3.10-1ubuntu3 - 5.3.10-1ubuntu3.26


CPE2.3 External links

http://www.ubuntu.com/usn/usn-3382-2/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

6) Stack-based buffer overflow

EUVDB-ID: #VU7356

Risk: High

CVSSv3.1:

CVE-ID: CVE-2017-11628

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition or potentially execute arbitrary code.

The weakness exists due to stack buffer overflow in PHP INI parsing API 2 when handling malicious input. A remote attacker can send specially crafted data, trigger stack buffer overflow in zend_ini_do_op() that may lead to out-of-bounds write, cause the application to crash or execute arbitrary code with web server privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Install updates from vendor's website:

Vulnerable software versions

php5 (Ubuntu package): 5.3.10-1ubuntu3 - 5.3.10-1ubuntu3.26


CPE2.3 External links

http://www.ubuntu.com/usn/usn-3382-2/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

7) Out-of-bounds read

EUVDB-ID: #VU7345

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2017-9224

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists in the mbstring due to stack out-of-bounds read in match_at() during regular expression searching. A remote attacker can trigger a logical error involving order of validation and access in match_at() and read arbitrary files on the system.

Successful exploitation of the vulnerability results in information disclosure.

Mitigation

Install updates from vendor's website:

Vulnerable software versions

php5 (Ubuntu package): 5.3.10-1ubuntu3 - 5.3.10-1ubuntu3.26


CPE2.3 External links

http://www.ubuntu.com/usn/usn-3382-2/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

8) Heap-out-of-bounds write

EUVDB-ID: #VU7346

Risk: High

CVSSv3.1:

CVE-ID: CVE-2017-9226

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists in the mbstring due to heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. A remote attacker can supply a malformed regular expression containing an octal number in the form of '\700', trigger
out-of-bounds write memory corruption and execute arbitrary code with web server privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Install updates from vendor's website:

Vulnerable software versions

php5 (Ubuntu package): 5.3.10-1ubuntu3 - 5.3.10-1ubuntu3.26


CPE2.3 External links

http://www.ubuntu.com/usn/usn-3382-2/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

9) Out-of-bounds read

EUVDB-ID: #VU7347

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2017-9227

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists in the mbstring due to an error in handling of reg->dmin in forward_search_range(). A remote attacker can trigger stack out-of-bounds read in mbc_enc_len() during regular expression searching and read arbitrary files on the system.

Successful exploitation of the vulnerability results in information disclosure.

Mitigation

Install updates from vendor's website:

Vulnerable software versions

php5 (Ubuntu package): 5.3.10-1ubuntu3 - 5.3.10-1ubuntu3.26


CPE2.3 External links

http://www.ubuntu.com/usn/usn-3382-2/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

10) Heap-out-of-bounds write

EUVDB-ID: #VU7348

Risk: High

CVSSv3.1:

CVE-ID: CVE-2017-9228

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists in the mbstring due to heap out-of-bounds write in bitset_set_range() during regular expression compilation due to incorrect state transition in parse_char_class(). A remote attacker can trigger out-of-bounds write memory corruption and execute arbitrary code with web server privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Install updates from vendor's website:

Vulnerable software versions

php5 (Ubuntu package): 5.3.10-1ubuntu3 - 5.3.10-1ubuntu3.26


CPE2.3 External links

http://www.ubuntu.com/usn/usn-3382-2/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

11) Null pointer dereference

EUVDB-ID: #VU7349

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2017-9229

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists in the mbstring due to an error in handling of reg->dmin in forward_search_range(). A remote attacker can trigger SIGSEGV in left_adjust_char_head() during regular expression compilation, cause NULL pointer dereference and the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Install updates from vendor's website:

Vulnerable software versions

php5 (Ubuntu package): 5.3.10-1ubuntu3 - 5.3.10-1ubuntu3.26


CPE2.3 External links

http://www.ubuntu.com/usn/usn-3382-2/

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###