Security update for php5 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:0424-1 Final 1 1 2015-02-26T13:36:21Z current 2015-02-26T13:36:21Z 2015-02-26T13:36:21Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for php5 php5 was updated to fix two security issues. These security issues were fixed: - CVE-2014-9652: Out of bounds read in mconvert() (bnc#917150). - CVE-2015-0273: Use after free vulnerability in unserialize() with DateTimeZone (bnc#918768). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Module-Web-Scripting-12-2015-105,SUSE-SLE-SDK-12-2015-105 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20150424-1/ Link for SUSE-SU-2015:0424-1 https://lists.opensuse.org/opensuse-security-announce/2015-03/msg00002.html E-Mail link for SUSE-SU-2015:0424-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/917150 SUSE Bug 917150 https://bugzilla.suse.com/918768 SUSE Bug 918768 https://www.suse.com/security/cve/CVE-2014-9652/ SUSE CVE CVE-2014-9652 page https://www.suse.com/security/cve/CVE-2015-0273/ SUSE CVE CVE-2015-0273 page SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Software Development Kit 12 apache2-mod_php5-5.5.14-15.1 php5-5.5.14-15.1 php5-bcmath-5.5.14-15.1 php5-bz2-5.5.14-15.1 php5-calendar-5.5.14-15.1 php5-ctype-5.5.14-15.1 php5-curl-5.5.14-15.1 php5-dba-5.5.14-15.1 php5-dom-5.5.14-15.1 php5-enchant-5.5.14-15.1 php5-exif-5.5.14-15.1 php5-fastcgi-5.5.14-15.1 php5-fileinfo-5.5.14-15.1 php5-fpm-5.5.14-15.1 php5-ftp-5.5.14-15.1 php5-gd-5.5.14-15.1 php5-gettext-5.5.14-15.1 php5-gmp-5.5.14-15.1 php5-iconv-5.5.14-15.1 php5-intl-5.5.14-15.1 php5-json-5.5.14-15.1 php5-ldap-5.5.14-15.1 php5-mbstring-5.5.14-15.1 php5-mcrypt-5.5.14-15.1 php5-mysql-5.5.14-15.1 php5-odbc-5.5.14-15.1 php5-openssl-5.5.14-15.1 php5-pcntl-5.5.14-15.1 php5-pdo-5.5.14-15.1 php5-pear-5.5.14-15.1 php5-pgsql-5.5.14-15.1 php5-pspell-5.5.14-15.1 php5-shmop-5.5.14-15.1 php5-snmp-5.5.14-15.1 php5-soap-5.5.14-15.1 php5-sockets-5.5.14-15.1 php5-sqlite-5.5.14-15.1 php5-suhosin-5.5.14-15.1 php5-sysvmsg-5.5.14-15.1 php5-sysvsem-5.5.14-15.1 php5-sysvshm-5.5.14-15.1 php5-tokenizer-5.5.14-15.1 php5-wddx-5.5.14-15.1 php5-xmlreader-5.5.14-15.1 php5-xmlrpc-5.5.14-15.1 php5-xmlwriter-5.5.14-15.1 php5-xsl-5.5.14-15.1 php5-zip-5.5.14-15.1 php5-zlib-5.5.14-15.1 php5-devel-5.5.14-15.1 apache2-mod_php5-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-bcmath-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-bz2-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-calendar-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-ctype-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-curl-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-dba-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-dom-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-enchant-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-exif-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-fastcgi-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-fileinfo-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-fpm-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-ftp-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-gd-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-gettext-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-gmp-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-iconv-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-intl-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-json-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-ldap-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-mbstring-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-mcrypt-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-mysql-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-odbc-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-openssl-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-pcntl-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-pdo-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-pear-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-pgsql-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-pspell-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-shmop-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-snmp-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-soap-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-sockets-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-sqlite-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-suhosin-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-sysvmsg-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-sysvsem-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-sysvshm-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-tokenizer-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-wddx-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-xmlreader-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-xmlrpc-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-xmlwriter-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-xsl-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-zip-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-zlib-5.5.14-15.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-devel-5.5.14-15.1 as a component of SUSE Linux Enterprise Software Development Kit 12 The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted file. CVE-2014-9652 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php5-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-bcmath-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-bz2-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-calendar-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-ctype-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-curl-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-dba-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-dom-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-enchant-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-exif-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-fastcgi-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-fileinfo-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-fpm-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-ftp-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-gd-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-gettext-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-gmp-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-iconv-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-intl-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-json-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-ldap-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-mbstring-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-mcrypt-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-mysql-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-odbc-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-openssl-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-pcntl-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-pdo-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-pear-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-pgsql-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-pspell-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-shmop-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-snmp-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-soap-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-sockets-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-sqlite-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-suhosin-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-sysvmsg-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-sysvsem-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-sysvshm-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-tokenizer-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-wddx-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-xmlreader-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-xmlrpc-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-xmlwriter-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-xsl-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-zip-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-zlib-5.5.14-15.1 SUSE Linux Enterprise Software Development Kit 12:php5-devel-5.5.14-15.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150424-1/ https://www.suse.com/security/cve/CVE-2014-9652.html CVE-2014-9652 https://bugzilla.suse.com/917150 SUSE Bug 917150 https://bugzilla.suse.com/917302 SUSE Bug 917302 https://bugzilla.suse.com/918768 SUSE Bug 918768 https://bugzilla.suse.com/980366 SUSE Bug 980366 Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allow remote attackers to execute arbitrary code via crafted serialized input containing a (1) R or (2) r type specifier in (a) DateTimeZone data handled by the php_date_timezone_initialize_from_hash function or (b) DateTime data handled by the php_date_initialize_from_hash function. CVE-2015-0273 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php5-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-bcmath-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-bz2-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-calendar-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-ctype-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-curl-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-dba-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-dom-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-enchant-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-exif-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-fastcgi-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-fileinfo-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-fpm-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-ftp-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-gd-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-gettext-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-gmp-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-iconv-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-intl-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-json-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-ldap-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-mbstring-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-mcrypt-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-mysql-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-odbc-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-openssl-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-pcntl-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-pdo-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-pear-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-pgsql-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-pspell-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-shmop-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-snmp-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-soap-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-sockets-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-sqlite-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-suhosin-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-sysvmsg-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-sysvsem-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-sysvshm-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-tokenizer-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-wddx-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-xmlreader-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-xmlrpc-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-xmlwriter-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-xsl-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-zip-5.5.14-15.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-zlib-5.5.14-15.1 SUSE Linux Enterprise Software Development Kit 12:php5-devel-5.5.14-15.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150424-1/ https://www.suse.com/security/cve/CVE-2015-0273.html CVE-2015-0273 https://bugzilla.suse.com/917302 SUSE Bug 917302 https://bugzilla.suse.com/918768 SUSE Bug 918768 https://bugzilla.suse.com/980366 SUSE Bug 980366