SB2018010412 - Multiple vulnerabilities in PHP
Published: January 4, 2018
Security Bulletin ID
SB2018010412
Severity
Medium
Patch available
YES
Number of vulnerabilities
3
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Improper restriction of XML external entity reference (XXE) (CVE-ID: CVE-2015-8866)
The vulnerability allows a remote attacker to perform XXE. attcks.The vulnerability exists in ext/libxml/libxml.c when using PHP-FPM due to improper isolation of each threat from libxml_disable_entity_loader changes in other threads. A remote attacker can perform XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document.
Note: this vulnerability is known at least since 2013 and it was patched several times.
2) Denial of service (CVE-ID: CVE-2018-5711)
The vulnerability allows a remote attacker to perform a denial of service attack.The vulnerability exists due to an error in gdImageCreateFromGifCtx() function when processing images with GD library. A remote attacker can create a specially crafted image, pass it to vulnerable application and perform a denial of service (DoS) attack via infinite loop.
3) Corss-site scrpting (CVE-ID: CVE-2018-5712)
The vulnerability allows a remote attacker to perform XSS attacks.The vulnerability exists due to improper input validation in .phar when processing 404 response. A remote attacker can create a specially crafted link, rick tyhe victim into opening it and execute arbitrary HTML and script code in victim's browser in context of vulnerable website.
Remediation
Install update from vendor's website.