Security update for php7 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:2303-1 Final 1 1 2017-08-30T13:18:53Z current 2017-08-30T13:18:53Z 2017-08-30T13:18:53Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for php7 This update for php7 fixes the following issues: - CVE-2016-10397: parse_url() can be bypassed to return fake host. (bsc#1047454) - CVE-2017-11142: Remoteattackers could cause a CPU consumption denial of service attack by injectinglong form variables, related to main/php_variables. (bsc#1048100) - CVE-2017-11144: The opensslextension PEM sealing code did not check the return value of the OpenSSL sealingfunction, which could lead to a crash. (bsc#1048096) - CVE-2017-11145: Lack of bounds checks in timelib_meridian coud lead to information leak. (bsc#1048112) - CVE-2017-11146: Lack of bounds checks in timelib_meridian parse code could lead to information leak. (bsc#1048111) - CVE-2017-11147: The PHAR archive handler could beused by attackers supplying malicious archive files to crash the PHP interpreteror potentially disclose information. (bsc#1048094) - CVE-2017-11628: Stack-base dbuffer overflow in zend_ini_do_op() could lead to denial of service (bsc#1050726) - CVE-2017-7890: Buffer over-read from unitialized data in gdImageCreateFromGifCtx function could lead to denial of service (bsc#1050241) - CVE-2016-5766: Integer Overflow in _gd2GetHeader() resulting in heap overflow could lead to denial of service or code execution (bsc#986386) Other fixes: - Soap Request with References (bsc#1053645) - php7-pear should explicitly require php7-pear-Archive_Tar otherwise this dependency must be declared in every php7-pear-* package explicitly. [bnc#1052389] The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Module-Web-Scripting-12-2017-1417,SUSE-SLE-SDK-12-SP2-2017-1417,SUSE-SLE-SDK-12-SP3-2017-1417 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20172303-1/ Link for SUSE-SU-2017:2303-1 https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00075.html E-Mail link for SUSE-SU-2017:2303-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1047454 SUSE Bug 1047454 https://bugzilla.suse.com/1048094 SUSE Bug 1048094 https://bugzilla.suse.com/1048096 SUSE Bug 1048096 https://bugzilla.suse.com/1048100 SUSE Bug 1048100 https://bugzilla.suse.com/1048111 SUSE Bug 1048111 https://bugzilla.suse.com/1048112 SUSE Bug 1048112 https://bugzilla.suse.com/1050241 SUSE Bug 1050241 https://bugzilla.suse.com/1050726 SUSE Bug 1050726 https://bugzilla.suse.com/1052389 SUSE Bug 1052389 https://bugzilla.suse.com/1053645 SUSE Bug 1053645 https://bugzilla.suse.com/986386 SUSE Bug 986386 https://www.suse.com/security/cve/CVE-2016-10397/ SUSE CVE CVE-2016-10397 page https://www.suse.com/security/cve/CVE-2016-5766/ SUSE CVE CVE-2016-5766 page https://www.suse.com/security/cve/CVE-2017-11142/ SUSE CVE CVE-2017-11142 page https://www.suse.com/security/cve/CVE-2017-11144/ SUSE CVE CVE-2017-11144 page https://www.suse.com/security/cve/CVE-2017-11145/ SUSE CVE CVE-2017-11145 page https://www.suse.com/security/cve/CVE-2017-11146/ SUSE CVE CVE-2017-11146 page https://www.suse.com/security/cve/CVE-2017-11147/ SUSE CVE CVE-2017-11147 page https://www.suse.com/security/cve/CVE-2017-11628/ SUSE CVE CVE-2017-11628 page https://www.suse.com/security/cve/CVE-2017-7890/ SUSE CVE CVE-2017-7890 page SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP3 apache2-mod_php7-7.0.7-50.9.2 php7-7.0.7-50.9.2 php7-bcmath-7.0.7-50.9.2 php7-bz2-7.0.7-50.9.2 php7-calendar-7.0.7-50.9.2 php7-ctype-7.0.7-50.9.2 php7-curl-7.0.7-50.9.2 php7-dba-7.0.7-50.9.2 php7-dom-7.0.7-50.9.2 php7-enchant-7.0.7-50.9.2 php7-exif-7.0.7-50.9.2 php7-fastcgi-7.0.7-50.9.2 php7-fileinfo-7.0.7-50.9.2 php7-fpm-7.0.7-50.9.2 php7-ftp-7.0.7-50.9.2 php7-gd-7.0.7-50.9.2 php7-gettext-7.0.7-50.9.2 php7-gmp-7.0.7-50.9.2 php7-iconv-7.0.7-50.9.2 php7-imap-7.0.7-50.9.2 php7-intl-7.0.7-50.9.2 php7-json-7.0.7-50.9.2 php7-ldap-7.0.7-50.9.2 php7-mbstring-7.0.7-50.9.2 php7-mcrypt-7.0.7-50.9.2 php7-mysql-7.0.7-50.9.2 php7-odbc-7.0.7-50.9.2 php7-opcache-7.0.7-50.9.2 php7-openssl-7.0.7-50.9.2 php7-pcntl-7.0.7-50.9.2 php7-pdo-7.0.7-50.9.2 php7-pear-7.0.7-50.9.2 php7-pear-Archive_Tar-7.0.7-50.9.2 php7-pgsql-7.0.7-50.9.2 php7-phar-7.0.7-50.9.2 php7-posix-7.0.7-50.9.2 php7-pspell-7.0.7-50.9.2 php7-shmop-7.0.7-50.9.2 php7-snmp-7.0.7-50.9.2 php7-soap-7.0.7-50.9.2 php7-sockets-7.0.7-50.9.2 php7-sqlite-7.0.7-50.9.2 php7-sysvmsg-7.0.7-50.9.2 php7-sysvsem-7.0.7-50.9.2 php7-sysvshm-7.0.7-50.9.2 php7-tokenizer-7.0.7-50.9.2 php7-wddx-7.0.7-50.9.2 php7-xmlreader-7.0.7-50.9.2 php7-xmlrpc-7.0.7-50.9.2 php7-xmlwriter-7.0.7-50.9.2 php7-xsl-7.0.7-50.9.2 php7-zip-7.0.7-50.9.2 php7-zlib-7.0.7-50.9.2 php7-devel-7.0.7-50.9.2 apache2-mod_php7-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-bcmath-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-bz2-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-calendar-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-ctype-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-curl-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-dba-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-dom-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-enchant-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-exif-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-fastcgi-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-fileinfo-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-fpm-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-ftp-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-gd-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-gettext-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-gmp-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-iconv-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-imap-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-intl-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-json-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-ldap-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-mbstring-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-mcrypt-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-mysql-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-odbc-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-opcache-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-openssl-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pcntl-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pdo-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pear-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pear-Archive_Tar-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pgsql-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-phar-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-posix-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pspell-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-shmop-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-snmp-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-soap-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-sockets-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-sqlite-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-sysvmsg-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-sysvsem-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-sysvshm-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-tokenizer-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-wddx-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-xmlreader-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-xmlrpc-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-xmlwriter-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-xsl-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-zip-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-zlib-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-devel-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 php7-devel-7.0.7-50.9.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to bypass hostname-specific URL checks, as demonstrated by evil.example.com:80#@good.example.com/ and evil.example.com:80?@good.example.com/ inputs to the parse_url function (implemented in the php_url_parse_ex function in ext/standard/url.c). CVE-2016-10397 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php7-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bcmath-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bz2-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-calendar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ctype-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-curl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dba-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dom-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-enchant-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-exif-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fastcgi-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fileinfo-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fpm-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ftp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gd-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gettext-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gmp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-iconv-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-imap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-intl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-json-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ldap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mbstring-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mcrypt-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mysql-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-odbc-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-opcache-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-openssl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pcntl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pdo-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-Archive_Tar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pgsql-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-phar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-posix-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pspell-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-shmop-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-snmp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-soap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sockets-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sqlite-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvmsg-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvsem-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvshm-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-tokenizer-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-wddx-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlreader-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlrpc-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlwriter-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xsl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zip-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zlib-7.0.7-50.9.2 SUSE Linux Enterprise Software Development Kit 12 SP2:php7-devel-7.0.7-50.9.2 SUSE Linux Enterprise Software Development Kit 12 SP3:php7-devel-7.0.7-50.9.2 important 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172303-1/ https://www.suse.com/security/cve/CVE-2016-10397.html CVE-2016-10397 https://bugzilla.suse.com/1047454 SUSE Bug 1047454 Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image. CVE-2016-5766 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php7-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bcmath-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bz2-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-calendar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ctype-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-curl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dba-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dom-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-enchant-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-exif-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fastcgi-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fileinfo-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fpm-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ftp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gd-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gettext-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gmp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-iconv-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-imap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-intl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-json-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ldap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mbstring-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mcrypt-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mysql-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-odbc-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-opcache-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-openssl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pcntl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pdo-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-Archive_Tar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pgsql-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-phar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-posix-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pspell-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-shmop-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-snmp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-soap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sockets-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sqlite-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvmsg-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvsem-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvshm-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-tokenizer-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-wddx-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlreader-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlrpc-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlwriter-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xsl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zip-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zlib-7.0.7-50.9.2 SUSE Linux Enterprise Software Development Kit 12 SP2:php7-devel-7.0.7-50.9.2 SUSE Linux Enterprise Software Development Kit 12 SP3:php7-devel-7.0.7-50.9.2 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172303-1/ https://www.suse.com/security/cve/CVE-2016-5766.html CVE-2016-5766 https://bugzilla.suse.com/986386 SUSE Bug 986386 In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c. CVE-2017-11142 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php7-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bcmath-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bz2-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-calendar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ctype-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-curl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dba-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dom-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-enchant-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-exif-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fastcgi-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fileinfo-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fpm-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ftp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gd-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gettext-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gmp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-iconv-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-imap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-intl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-json-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ldap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mbstring-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mcrypt-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mysql-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-odbc-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-opcache-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-openssl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pcntl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pdo-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-Archive_Tar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pgsql-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-phar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-posix-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pspell-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-shmop-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-snmp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-soap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sockets-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sqlite-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvmsg-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvsem-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvshm-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-tokenizer-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-wddx-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlreader-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlrpc-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlwriter-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xsl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zip-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zlib-7.0.7-50.9.2 SUSE Linux Enterprise Software Development Kit 12 SP2:php7-devel-7.0.7-50.9.2 SUSE Linux Enterprise Software Development Kit 12 SP3:php7-devel-7.0.7-50.9.2 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172303-1/ https://www.suse.com/security/cve/CVE-2017-11142.html CVE-2017-11142 https://bugzilla.suse.com/1048100 SUSE Bug 1048100 In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission. CVE-2017-11144 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php7-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bcmath-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bz2-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-calendar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ctype-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-curl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dba-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dom-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-enchant-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-exif-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fastcgi-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fileinfo-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fpm-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ftp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gd-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gettext-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gmp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-iconv-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-imap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-intl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-json-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ldap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mbstring-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mcrypt-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mysql-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-odbc-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-opcache-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-openssl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pcntl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pdo-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-Archive_Tar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pgsql-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-phar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-posix-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pspell-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-shmop-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-snmp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-soap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sockets-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sqlite-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvmsg-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvsem-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvshm-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-tokenizer-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-wddx-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlreader-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlrpc-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlwriter-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xsl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zip-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zlib-7.0.7-50.9.2 SUSE Linux Enterprise Software Development Kit 12 SP2:php7-devel-7.0.7-50.9.2 SUSE Linux Enterprise Software Development Kit 12 SP3:php7-devel-7.0.7-50.9.2 important 4 AV:N/AC:H/Au:N/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172303-1/ https://www.suse.com/security/cve/CVE-2017-11144.html CVE-2017-11144 https://bugzilla.suse.com/1048096 SUSE Bug 1048096 In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, an error in the date extension's timelib_meridian parsing code could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: the correct fix is in the e8b7698f5ee757ce2c8bd10a192a491a498f891c commit, not the bd77ac90d3bdf31ce2a5251ad92e9e75 gist. CVE-2017-11145 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php7-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bcmath-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bz2-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-calendar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ctype-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-curl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dba-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dom-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-enchant-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-exif-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fastcgi-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fileinfo-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fpm-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ftp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gd-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gettext-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gmp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-iconv-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-imap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-intl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-json-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ldap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mbstring-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mcrypt-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mysql-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-odbc-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-opcache-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-openssl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pcntl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pdo-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-Archive_Tar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pgsql-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-phar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-posix-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pspell-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-shmop-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-snmp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-soap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sockets-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sqlite-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvmsg-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvsem-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvshm-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-tokenizer-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-wddx-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlreader-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlrpc-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlwriter-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xsl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zip-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zlib-7.0.7-50.9.2 SUSE Linux Enterprise Software Development Kit 12 SP2:php7-devel-7.0.7-50.9.2 SUSE Linux Enterprise Software Development Kit 12 SP3:php7-devel-7.0.7-50.9.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172303-1/ https://www.suse.com/security/cve/CVE-2017-11145.html CVE-2017-11145 https://bugzilla.suse.com/1048111 SUSE Bug 1048111 https://bugzilla.suse.com/1048112 SUSE Bug 1048112 https://bugzilla.suse.com/1067441 SUSE Bug 1067441 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not an independently fixable security issue relative to CVE-2017-11145. Notes: none. CVE-2017-11146 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php7-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bcmath-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bz2-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-calendar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ctype-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-curl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dba-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dom-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-enchant-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-exif-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fastcgi-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fileinfo-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fpm-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ftp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gd-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gettext-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gmp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-iconv-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-imap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-intl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-json-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ldap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mbstring-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mcrypt-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mysql-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-odbc-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-opcache-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-openssl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pcntl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pdo-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-Archive_Tar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pgsql-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-phar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-posix-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pspell-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-shmop-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-snmp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-soap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sockets-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sqlite-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvmsg-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvsem-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvshm-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-tokenizer-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-wddx-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlreader-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlrpc-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlwriter-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xsl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zip-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zlib-7.0.7-50.9.2 SUSE Linux Enterprise Software Development Kit 12 SP2:php7-devel-7.0.7-50.9.2 SUSE Linux Enterprise Software Development Kit 12 SP3:php7-devel-7.0.7-50.9.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172303-1/ https://www.suse.com/security/cve/CVE-2017-11146.html CVE-2017-11146 https://bugzilla.suse.com/1048111 SUSE Bug 1048111 https://bugzilla.suse.com/1048112 SUSE Bug 1048112 In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c. CVE-2017-11147 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php7-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bcmath-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bz2-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-calendar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ctype-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-curl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dba-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dom-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-enchant-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-exif-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fastcgi-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fileinfo-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fpm-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ftp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gd-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gettext-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gmp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-iconv-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-imap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-intl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-json-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ldap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mbstring-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mcrypt-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mysql-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-odbc-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-opcache-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-openssl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pcntl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pdo-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-Archive_Tar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pgsql-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-phar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-posix-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pspell-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-shmop-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-snmp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-soap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sockets-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sqlite-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvmsg-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvsem-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvshm-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-tokenizer-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-wddx-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlreader-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlrpc-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlwriter-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xsl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zip-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zlib-7.0.7-50.9.2 SUSE Linux Enterprise Software Development Kit 12 SP2:php7-devel-7.0.7-50.9.2 SUSE Linux Enterprise Software Development Kit 12 SP3:php7-devel-7.0.7-50.9.2 important 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172303-1/ https://www.suse.com/security/cve/CVE-2017-11147.html CVE-2017-11147 https://bugzilla.suse.com/1048094 SUSE Bug 1048094 In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend_ini_parser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input (instead of the system's php.ini file) for the parse_ini_string or parse_ini_file function, e.g., a web application for syntax validation of php.ini directives. CVE-2017-11628 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php7-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bcmath-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bz2-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-calendar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ctype-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-curl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dba-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dom-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-enchant-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-exif-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fastcgi-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fileinfo-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fpm-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ftp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gd-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gettext-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gmp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-iconv-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-imap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-intl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-json-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ldap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mbstring-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mcrypt-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mysql-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-odbc-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-opcache-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-openssl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pcntl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pdo-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-Archive_Tar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pgsql-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-phar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-posix-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pspell-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-shmop-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-snmp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-soap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sockets-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sqlite-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvmsg-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvsem-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvshm-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-tokenizer-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-wddx-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlreader-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlrpc-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlwriter-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xsl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zip-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zlib-7.0.7-50.9.2 SUSE Linux Enterprise Software Development Kit 12 SP2:php7-devel-7.0.7-50.9.2 SUSE Linux Enterprise Software Development Kit 12 SP3:php7-devel-7.0.7-50.9.2 important 3.7 AV:L/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172303-1/ https://www.suse.com/security/cve/CVE-2017-11628.html CVE-2017-11628 https://bugzilla.suse.com/1050726 SUSE Bug 1050726 The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information. CVE-2017-7890 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php7-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bcmath-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bz2-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-calendar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ctype-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-curl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dba-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dom-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-enchant-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-exif-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fastcgi-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fileinfo-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fpm-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ftp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gd-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gettext-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gmp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-iconv-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-imap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-intl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-json-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ldap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mbstring-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mcrypt-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mysql-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-odbc-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-opcache-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-openssl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pcntl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pdo-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-Archive_Tar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pgsql-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-phar-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-posix-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pspell-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-shmop-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-snmp-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-soap-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sockets-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sqlite-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvmsg-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvsem-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvshm-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-tokenizer-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-wddx-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlreader-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlrpc-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlwriter-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xsl-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zip-7.0.7-50.9.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zlib-7.0.7-50.9.2 SUSE Linux Enterprise Software Development Kit 12 SP2:php7-devel-7.0.7-50.9.2 SUSE Linux Enterprise Software Development Kit 12 SP3:php7-devel-7.0.7-50.9.2 important 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172303-1/ https://www.suse.com/security/cve/CVE-2017-7890.html CVE-2017-7890 https://bugzilla.suse.com/1050241 SUSE Bug 1050241