Security update for php72 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:0988-1 Final 1 1 2019-04-23T06:46:19Z current 2019-04-23T06:46:19Z 2019-04-23T06:46:19Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for php72 This update for php72 fixes the following issues: - CVE-2019-9637: Due to the way rename() across filesystems is implemented, it was possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to access the data. (bsc#1128892) - CVE-2019-9675: phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: 'This issue allows theoretical compromise of security, but a practical attack is usually impossible.' (bsc#1128886) - CVE-2019-9638: An issue was discovered in the EXIF component in PHP. There was an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the maker_note->offset relationship to value_len. (bsc#1128889) - CVE-2019-9639: An issue was discovered in the EXIF component in PHP. There was an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the data_len variable. (bsc#1128887) - CVE-2019-9640: An issue was discovered in the EXIF component in PHP. There was an Invalid Read in exif_process_SOFn. (bsc#1128883) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-988,SUSE-SLE-Module-Web-Scripting-12-2019-988,SUSE-SLE-SDK-12-SP3-2019-988,SUSE-SLE-SDK-12-SP4-2019-988 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20190988-1/ Link for SUSE-SU-2019:0988-1 https://lists.suse.com/pipermail/sle-security-updates/2019-April/005351.html E-Mail link for SUSE-SU-2019:0988-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1128883 SUSE Bug 1128883 https://bugzilla.suse.com/1128886 SUSE Bug 1128886 https://bugzilla.suse.com/1128887 SUSE Bug 1128887 https://bugzilla.suse.com/1128889 SUSE Bug 1128889 https://bugzilla.suse.com/1128892 SUSE Bug 1128892 https://www.suse.com/security/cve/CVE-2019-9637/ SUSE CVE CVE-2019-9637 page https://www.suse.com/security/cve/CVE-2019-9638/ SUSE CVE CVE-2019-9638 page https://www.suse.com/security/cve/CVE-2019-9639/ SUSE CVE CVE-2019-9639 page https://www.suse.com/security/cve/CVE-2019-9640/ SUSE CVE CVE-2019-9640 page https://www.suse.com/security/cve/CVE-2019-9675/ SUSE CVE CVE-2019-9675 page SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP4 apache2-mod_php72-7.2.5-1.10.1 php72-7.2.5-1.10.1 php72-bcmath-7.2.5-1.10.1 php72-bz2-7.2.5-1.10.1 php72-calendar-7.2.5-1.10.1 php72-ctype-7.2.5-1.10.1 php72-curl-7.2.5-1.10.1 php72-dba-7.2.5-1.10.1 php72-devel-7.2.5-1.10.1 php72-dom-7.2.5-1.10.1 php72-embed-7.2.5-1.10.1 php72-enchant-7.2.5-1.10.1 php72-exif-7.2.5-1.10.1 php72-fastcgi-7.2.5-1.10.1 php72-fileinfo-7.2.5-1.10.1 php72-fpm-7.2.5-1.10.1 php72-ftp-7.2.5-1.10.1 php72-gd-7.2.5-1.10.1 php72-gettext-7.2.5-1.10.1 php72-gmp-7.2.5-1.10.1 php72-iconv-7.2.5-1.10.1 php72-imap-7.2.5-1.10.1 php72-intl-7.2.5-1.10.1 php72-json-7.2.5-1.10.1 php72-ldap-7.2.5-1.10.1 php72-mbstring-7.2.5-1.10.1 php72-mysql-7.2.5-1.10.1 php72-odbc-7.2.5-1.10.1 php72-opcache-7.2.5-1.10.1 php72-openssl-7.2.5-1.10.1 php72-pcntl-7.2.5-1.10.1 php72-pdo-7.2.5-1.10.1 php72-pear-7.2.5-1.10.1 php72-pear-Archive_Tar-7.2.5-1.10.1 php72-pgsql-7.2.5-1.10.1 php72-phar-7.2.5-1.10.1 php72-posix-7.2.5-1.10.1 php72-pspell-7.2.5-1.10.1 php72-readline-7.2.5-1.10.1 php72-shmop-7.2.5-1.10.1 php72-snmp-7.2.5-1.10.1 php72-soap-7.2.5-1.10.1 php72-sockets-7.2.5-1.10.1 php72-sqlite-7.2.5-1.10.1 php72-sysvmsg-7.2.5-1.10.1 php72-sysvsem-7.2.5-1.10.1 php72-sysvshm-7.2.5-1.10.1 php72-tidy-7.2.5-1.10.1 php72-tokenizer-7.2.5-1.10.1 php72-wddx-7.2.5-1.10.1 php72-xmlreader-7.2.5-1.10.1 php72-xmlrpc-7.2.5-1.10.1 php72-xmlwriter-7.2.5-1.10.1 php72-xsl-7.2.5-1.10.1 php72-zip-7.2.5-1.10.1 php72-zlib-7.2.5-1.10.1 apache2-mod_php72-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-bcmath-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-bz2-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-calendar-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-ctype-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-curl-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-dba-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-dom-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-enchant-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-exif-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-fastcgi-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-fileinfo-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-fpm-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-ftp-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-gd-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-gettext-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-gmp-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-iconv-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-imap-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-intl-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-json-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-ldap-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-mbstring-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-mysql-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-odbc-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-opcache-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-openssl-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-pcntl-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-pdo-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-pear-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-pear-Archive_Tar-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-pgsql-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-phar-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-posix-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-pspell-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-readline-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-shmop-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-snmp-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-soap-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-sockets-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-sqlite-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-sysvmsg-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-sysvsem-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-sysvshm-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-tidy-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-tokenizer-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-wddx-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-xmlreader-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-xmlrpc-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-xmlwriter-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-xsl-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-zip-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-zlib-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-devel-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 php72-devel-7.2.5-1.10.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rename() across filesystems is implemented, it is possible that file being renamed is briefly available with wrong permissions while the rename is ongoing, thus enabling unauthorized users to access the data. CVE-2019-9637 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php72-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-bcmath-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-bz2-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-calendar-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ctype-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-curl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-dba-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-dom-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-enchant-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-exif-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fastcgi-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fileinfo-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fpm-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ftp-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gd-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gettext-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gmp-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-iconv-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-imap-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-intl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-json-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ldap-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-mbstring-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-mysql-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-odbc-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-opcache-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-openssl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pcntl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pdo-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pear-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pear-Archive_Tar-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pgsql-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-phar-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-posix-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pspell-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-readline-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-shmop-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-snmp-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-soap-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sockets-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sqlite-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvmsg-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvsem-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvshm-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-tidy-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-tokenizer-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-wddx-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlreader-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlrpc-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlwriter-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xsl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-zip-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-zlib-7.2.5-1.10.1 SUSE Linux Enterprise Software Development Kit 12 SP3:php72-devel-7.2.5-1.10.1 SUSE Linux Enterprise Software Development Kit 12 SP4:php72-devel-7.2.5-1.10.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190988-1/ https://www.suse.com/security/cve/CVE-2019-9637.html CVE-2019-9637 https://bugzilla.suse.com/1128892 SUSE Bug 1128892 An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the maker_note->offset relationship to value_len. CVE-2019-9638 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php72-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-bcmath-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-bz2-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-calendar-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ctype-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-curl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-dba-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-dom-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-enchant-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-exif-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fastcgi-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fileinfo-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fpm-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ftp-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gd-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gettext-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gmp-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-iconv-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-imap-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-intl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-json-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ldap-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-mbstring-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-mysql-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-odbc-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-opcache-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-openssl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pcntl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pdo-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pear-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pear-Archive_Tar-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pgsql-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-phar-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-posix-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pspell-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-readline-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-shmop-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-snmp-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-soap-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sockets-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sqlite-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvmsg-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvsem-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvshm-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-tidy-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-tokenizer-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-wddx-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlreader-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlrpc-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlwriter-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xsl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-zip-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-zlib-7.2.5-1.10.1 SUSE Linux Enterprise Software Development Kit 12 SP3:php72-devel-7.2.5-1.10.1 SUSE Linux Enterprise Software Development Kit 12 SP4:php72-devel-7.2.5-1.10.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190988-1/ https://www.suse.com/security/cve/CVE-2019-9638.html CVE-2019-9638 https://bugzilla.suse.com/1128889 SUSE Bug 1128889 An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the data_len variable. CVE-2019-9639 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php72-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-bcmath-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-bz2-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-calendar-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ctype-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-curl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-dba-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-dom-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-enchant-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-exif-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fastcgi-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fileinfo-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fpm-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ftp-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gd-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gettext-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gmp-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-iconv-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-imap-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-intl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-json-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ldap-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-mbstring-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-mysql-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-odbc-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-opcache-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-openssl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pcntl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pdo-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pear-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pear-Archive_Tar-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pgsql-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-phar-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-posix-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pspell-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-readline-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-shmop-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-snmp-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-soap-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sockets-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sqlite-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvmsg-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvsem-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvshm-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-tidy-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-tokenizer-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-wddx-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlreader-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlrpc-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlwriter-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xsl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-zip-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-zlib-7.2.5-1.10.1 SUSE Linux Enterprise Software Development Kit 12 SP3:php72-devel-7.2.5-1.10.1 SUSE Linux Enterprise Software Development Kit 12 SP4:php72-devel-7.2.5-1.10.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190988-1/ https://www.suse.com/security/cve/CVE-2019-9639.html CVE-2019-9639 https://bugzilla.suse.com/1128887 SUSE Bug 1128887 An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an Invalid Read in exif_process_SOFn. CVE-2019-9640 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php72-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-bcmath-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-bz2-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-calendar-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ctype-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-curl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-dba-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-dom-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-enchant-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-exif-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fastcgi-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fileinfo-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fpm-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ftp-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gd-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gettext-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gmp-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-iconv-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-imap-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-intl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-json-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ldap-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-mbstring-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-mysql-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-odbc-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-opcache-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-openssl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pcntl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pdo-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pear-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pear-Archive_Tar-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pgsql-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-phar-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-posix-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pspell-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-readline-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-shmop-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-snmp-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-soap-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sockets-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sqlite-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvmsg-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvsem-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvshm-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-tidy-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-tokenizer-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-wddx-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlreader-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlrpc-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlwriter-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xsl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-zip-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-zlib-7.2.5-1.10.1 SUSE Linux Enterprise Software Development Kit 12 SP3:php72-devel-7.2.5-1.10.1 SUSE Linux Enterprise Software Development Kit 12 SP4:php72-devel-7.2.5-1.10.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190988-1/ https://www.suse.com/security/cve/CVE-2019-9640.html CVE-2019-9640 https://bugzilla.suse.com/1128883 SUSE Bug 1128883 ** DISPUTED ** An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow via a long link value. NOTE: The vendor indicates that the link value is used only when an archive contains a symlink, which currently cannot happen: "This issue allows theoretical compromise of security, but a practical attack is usually impossible." CVE-2019-9675 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php72-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-bcmath-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-bz2-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-calendar-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ctype-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-curl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-dba-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-dom-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-enchant-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-exif-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fastcgi-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fileinfo-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fpm-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ftp-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gd-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gettext-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gmp-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-iconv-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-imap-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-intl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-json-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ldap-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-mbstring-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-mysql-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-odbc-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-opcache-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-openssl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pcntl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pdo-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pear-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pear-Archive_Tar-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pgsql-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-phar-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-posix-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pspell-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-readline-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-shmop-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-snmp-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-soap-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sockets-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sqlite-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvmsg-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvsem-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvshm-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-tidy-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-tokenizer-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-wddx-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlreader-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlrpc-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlwriter-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xsl-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-zip-7.2.5-1.10.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-zlib-7.2.5-1.10.1 SUSE Linux Enterprise Software Development Kit 12 SP3:php72-devel-7.2.5-1.10.1 SUSE Linux Enterprise Software Development Kit 12 SP4:php72-devel-7.2.5-1.10.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190988-1/ https://www.suse.com/security/cve/CVE-2019-9675.html CVE-2019-9675 https://bugzilla.suse.com/1128886 SUSE Bug 1128886