SB2019030624 - Ubuntu update for php5, php7.0
Published: March 6, 2019 Updated: October 30, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 15 vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2019-9020)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the xml_elem_parse_buf() in ext/xmlrpc/libxmlrpc/xml_element.c when reading XML data via the xmlrpc_decode() PHP function. A remote attacker can create a specially crafted XML file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.
2) Heap out-of-bounds read (CVE-ID: CVE-2019-9020)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to heap out-of-bounds read when php is compiled with address sanitizer and USE_ZEND_ALLOC=0 is set. A remote attacker can supply a specially crafted input to the function xmlrpc_decode() , trigger heap buffer over-read and cause the service to crash.
3) Out-of-bounds read (CVE-ID: CVE-2019-9021)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the phar_detect_phar_fname_ext() function in ext/phar/phar.c (PHAR extension) when reading PHAR archives. A remote attacker can create a specially crafted PHAR archive, pass it to the affected application, trigger out-of-bounds read error and read contents of memory on the system.
4) Heap-based buffer overflow (CVE-ID: CVE-2019-9021)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to heap-based buffer overflow in phar_detect_phar_fname_ext. A remote attacker can supply a specially crafted input, trigger memory corruption and cause the service to crash.
5) Out-of-bounds read (CVE-ID: CVE-2019-9022)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the php_parserr in ext/standard/dns.c when processing DNS_CAA and DNS_ANY responses. A remote attacker controlling a malicious DNS server can trigger out-of-bounds read error and read contents of memory on the system.
6) Out-of-bounds read (CVE-ID: CVE-2019-9023)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a multiple boundary condition within the ext/mbstring/oniguruma/regcomp.c, ext/mbstring/oniguruma/regexec.c, ext/mbstring/oniguruma/regparse.c, ext/mbstring/oniguruma/enc/unicode.c, and ext/mbstring/oniguruma/src/utf32_be.c files when parsing multibyte data in regular expressions. A remote attacker can pass specially crafted input to the application, trigger out-of-bounds read error and read contents of memory on the system.
7) Buffer overflow (CVE-ID: CVE-2019-9023)
CWE-ID: CWE-120 - Buffer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to boundary error when using mb regex functions such as mb_ereg and mb_split, with a pattern containing (?i) and a string ending with an incomplete multibyte character. A remote attacker can trigger buffer overflow in multibyte case folding - unicode and cause the service to crash.
8) Buffer overflow (CVE-ID: CVE-2019-9023)
CWE-ID: CWE-120 - Buffer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to an incomplete multibyte strings in the $pattern of mb_ regex functions, such as mb_split, mb_ereg. A remote attacker can trigger buffer overflow on mb regex functions - fetch_token and cause the service to crash.
9) Heap-based buffer overflow (CVE-ID: CVE-2019-9023)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to an incomplete multibyte strings in $pattern in mb regex functions such as mb_ereg, mb_split. A remote attacker can trigger heap-based buffer overflow in mb regex functions - compile_string_node and cause the service to crash.
10) Heap-based buffer overflow (CVE-ID: CVE-2019-9023)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to an incomplete multibyte char at end of $pattern in mb_split and mb_ereg. A remote attacker can trigger heap-based buffer overflow in multibyte match_at and cause the service to crash.
11) Heap-based buffer overflow (CVE-ID: CVE-2019-9023)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists in expand_case_fold_string the len field is calculated off enclen, and is then used in onig_node_new_str which is passed to xmemcpy later down the line due to incorrect length in expand_case_fold_string. A remote attacker can trigger heap-based buffer overflow and cause the service to crash.
12) Buffer overflow (CVE-ID: CVE-2019-9023)
CWE-ID: CWE-120 - Buffer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to buffer overflow in fetch_token when using enclen on an incomplete multibyte character. A remote attacker
can make a pointer return after the end of the buffer and cause the service to crash.
13) Heap-based buffer overflow (CVE-ID: CVE-2019-9023)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to heap-based buffer overflow in utf32be_mbc_to_code. A remote attacker can pass unterminated multibyte to the regex match, trigger memory corruption and cause the service to crash.
14) Out-of-bounds read (CVE-ID: CVE-2019-9024)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the base64_decode_xmlrpc() function in ext/xmlrpc/libxmlrpc/base64.c when parsing untrusted input via the xmlrpc_decode() PHP function. A remote attacker can setup a malicious XMLRPC server, trick the application into connecting to it, trigger out-of-bounds read error and read contents of memory on the system.
15) Out-of-bounds read (CVE-ID: CVE-2019-9024)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to out-of-bounds read during a second base64 implementation in ext/xmlrpc/libxmlrpc/base64.c in the PHP code. A remote attacker can supply a bad base64 input, trigger buffer over-read and cause the service to crash.
Remediation
Install update from vendor's website.