Security update for php7 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0308-1 Final 1 1 2018-01-30T16:38:32Z current 2018-01-30T16:38:32Z 2018-01-30T16:38:32Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for php7 This update for php7 fixes several issues. These security issues were fixed: - CVE-2018-5712: Prevent reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file that allowed for information disclosure (bsc#1076220). - CVE-2018-5711: Prevent integer signedness error that could have lead to an infinite loop via a crafted GIF file allowing for DoS (bsc#1076391) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-Module-Web-Scripting-12-2018-224,SUSE-SLE-SDK-12-SP2-2018-224,SUSE-SLE-SDK-12-SP3-2018-224 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180308-1/ Link for SUSE-SU-2018:0308-1 https://lists.suse.com/pipermail/sle-security-updates/2018-January/003690.html E-Mail link for SUSE-SU-2018:0308-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1076220 SUSE Bug 1076220 https://bugzilla.suse.com/1076391 SUSE Bug 1076391 https://www.suse.com/security/cve/CVE-2018-5711/ SUSE CVE CVE-2018-5711 page https://www.suse.com/security/cve/CVE-2018-5712/ SUSE CVE CVE-2018-5712 page SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP3 apache2-mod_php7-7.0.7-50.26.1 php7-7.0.7-50.26.1 php7-bcmath-7.0.7-50.26.1 php7-bz2-7.0.7-50.26.1 php7-calendar-7.0.7-50.26.1 php7-ctype-7.0.7-50.26.1 php7-curl-7.0.7-50.26.1 php7-dba-7.0.7-50.26.1 php7-dom-7.0.7-50.26.1 php7-enchant-7.0.7-50.26.1 php7-exif-7.0.7-50.26.1 php7-fastcgi-7.0.7-50.26.1 php7-fileinfo-7.0.7-50.26.1 php7-fpm-7.0.7-50.26.1 php7-ftp-7.0.7-50.26.1 php7-gd-7.0.7-50.26.1 php7-gettext-7.0.7-50.26.1 php7-gmp-7.0.7-50.26.1 php7-iconv-7.0.7-50.26.1 php7-imap-7.0.7-50.26.1 php7-intl-7.0.7-50.26.1 php7-json-7.0.7-50.26.1 php7-ldap-7.0.7-50.26.1 php7-mbstring-7.0.7-50.26.1 php7-mcrypt-7.0.7-50.26.1 php7-mysql-7.0.7-50.26.1 php7-odbc-7.0.7-50.26.1 php7-opcache-7.0.7-50.26.1 php7-openssl-7.0.7-50.26.1 php7-pcntl-7.0.7-50.26.1 php7-pdo-7.0.7-50.26.1 php7-pear-7.0.7-50.26.1 php7-pear-Archive_Tar-7.0.7-50.26.1 php7-pgsql-7.0.7-50.26.1 php7-phar-7.0.7-50.26.1 php7-posix-7.0.7-50.26.1 php7-pspell-7.0.7-50.26.1 php7-shmop-7.0.7-50.26.1 php7-snmp-7.0.7-50.26.1 php7-soap-7.0.7-50.26.1 php7-sockets-7.0.7-50.26.1 php7-sqlite-7.0.7-50.26.1 php7-sysvmsg-7.0.7-50.26.1 php7-sysvsem-7.0.7-50.26.1 php7-sysvshm-7.0.7-50.26.1 php7-tokenizer-7.0.7-50.26.1 php7-wddx-7.0.7-50.26.1 php7-xmlreader-7.0.7-50.26.1 php7-xmlrpc-7.0.7-50.26.1 php7-xmlwriter-7.0.7-50.26.1 php7-xsl-7.0.7-50.26.1 php7-zip-7.0.7-50.26.1 php7-zlib-7.0.7-50.26.1 php7-devel-7.0.7-50.26.1 apache2-mod_php7-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-bcmath-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-bz2-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-calendar-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-ctype-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-curl-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-dba-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-dom-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-enchant-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-exif-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-fastcgi-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-fileinfo-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-fpm-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-ftp-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-gd-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-gettext-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-gmp-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-iconv-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-imap-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-intl-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-json-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-ldap-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-mbstring-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-mcrypt-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-mysql-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-odbc-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-opcache-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-openssl-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pcntl-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pdo-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pear-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pear-Archive_Tar-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pgsql-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-phar-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-posix-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pspell-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-shmop-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-snmp-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-soap-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-sockets-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-sqlite-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-sysvmsg-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-sysvsem-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-sysvshm-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-tokenizer-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-wddx-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-xmlreader-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-xmlrpc-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-xmlwriter-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-xsl-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-zip-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-zlib-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-devel-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 php7-devel-7.0.7-50.26.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or imagecreatefromstring PHP function. This is related to GetCode_ and gdImageCreateFromGifCtx. CVE-2018-5711 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php7-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bcmath-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bz2-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-calendar-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ctype-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-curl-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dba-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dom-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-enchant-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-exif-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fastcgi-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fileinfo-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fpm-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ftp-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gd-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gettext-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gmp-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-iconv-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-imap-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-intl-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-json-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ldap-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mbstring-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mcrypt-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mysql-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-odbc-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-opcache-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-openssl-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pcntl-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pdo-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-Archive_Tar-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pgsql-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-phar-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-posix-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pspell-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-shmop-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-snmp-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-soap-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sockets-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sqlite-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvmsg-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvsem-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvshm-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-tokenizer-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-wddx-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlreader-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlrpc-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlwriter-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xsl-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zip-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zlib-7.0.7-50.26.1 SUSE Linux Enterprise Software Development Kit 12 SP2:php7-devel-7.0.7-50.26.1 SUSE Linux Enterprise Software Development Kit 12 SP3:php7-devel-7.0.7-50.26.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180308-1/ https://www.suse.com/security/cve/CVE-2018-5711.html CVE-2018-5711 https://bugzilla.suse.com/1076391 SUSE Bug 1076391 An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file. CVE-2018-5712 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php7-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bcmath-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bz2-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-calendar-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ctype-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-curl-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dba-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dom-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-enchant-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-exif-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fastcgi-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fileinfo-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fpm-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ftp-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gd-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gettext-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gmp-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-iconv-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-imap-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-intl-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-json-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ldap-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mbstring-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mcrypt-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mysql-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-odbc-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-opcache-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-openssl-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pcntl-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pdo-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-Archive_Tar-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pgsql-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-phar-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-posix-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pspell-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-shmop-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-snmp-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-soap-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sockets-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sqlite-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvmsg-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvsem-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvshm-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-tokenizer-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-wddx-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlreader-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlrpc-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlwriter-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xsl-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zip-7.0.7-50.26.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zlib-7.0.7-50.26.1 SUSE Linux Enterprise Software Development Kit 12 SP2:php7-devel-7.0.7-50.26.1 SUSE Linux Enterprise Software Development Kit 12 SP3:php7-devel-7.0.7-50.26.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180308-1/ https://www.suse.com/security/cve/CVE-2018-5712.html CVE-2018-5712 https://bugzilla.suse.com/1076220 SUSE Bug 1076220 https://bugzilla.suse.com/1076391 SUSE Bug 1076391 https://bugzilla.suse.com/1091362 SUSE Bug 1091362