Security update for php72 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:2270-1 Final 1 1 2019-09-02T14:20:10Z current 2019-09-02T14:20:10Z 2019-09-02T14:20:10Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for php72 This update for php72 fixes the following issues: Security issues fixed: - CVE-2019-11041: Fixed heap buffer over-read in exif_scan_thumbnail() (bsc#1146360). - CVE-2019-11042: Fixed heap buffer over-read in exif_process_user_comment() (bsc#1145095). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-2270,SUSE-SLE-Module-Web-Scripting-12-2019-2270,SUSE-SLE-SDK-12-SP4-2019-2270 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20192270-1/ Link for SUSE-SU-2019:2270-1 https://lists.suse.com/pipermail/sle-security-updates/2019-September/005873.html E-Mail link for SUSE-SU-2019:2270-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1145095 SUSE Bug 1145095 https://bugzilla.suse.com/1146360 SUSE Bug 1146360 https://www.suse.com/security/cve/CVE-2019-11041/ SUSE CVE CVE-2019-11041 page https://www.suse.com/security/cve/CVE-2019-11042/ SUSE CVE CVE-2019-11042 page SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Software Development Kit 12 SP4 apache2-mod_php72-7.2.5-1.23.1 php72-7.2.5-1.23.1 php72-bcmath-7.2.5-1.23.1 php72-bz2-7.2.5-1.23.1 php72-calendar-7.2.5-1.23.1 php72-ctype-7.2.5-1.23.1 php72-curl-7.2.5-1.23.1 php72-dba-7.2.5-1.23.1 php72-devel-7.2.5-1.23.1 php72-dom-7.2.5-1.23.1 php72-embed-7.2.5-1.23.1 php72-enchant-7.2.5-1.23.1 php72-exif-7.2.5-1.23.1 php72-fastcgi-7.2.5-1.23.1 php72-fileinfo-7.2.5-1.23.1 php72-fpm-7.2.5-1.23.1 php72-ftp-7.2.5-1.23.1 php72-gd-7.2.5-1.23.1 php72-gettext-7.2.5-1.23.1 php72-gmp-7.2.5-1.23.1 php72-iconv-7.2.5-1.23.1 php72-imap-7.2.5-1.23.1 php72-intl-7.2.5-1.23.1 php72-json-7.2.5-1.23.1 php72-ldap-7.2.5-1.23.1 php72-mbstring-7.2.5-1.23.1 php72-mysql-7.2.5-1.23.1 php72-odbc-7.2.5-1.23.1 php72-opcache-7.2.5-1.23.1 php72-openssl-7.2.5-1.23.1 php72-pcntl-7.2.5-1.23.1 php72-pdo-7.2.5-1.23.1 php72-pear-7.2.5-1.23.1 php72-pear-Archive_Tar-7.2.5-1.23.1 php72-pgsql-7.2.5-1.23.1 php72-phar-7.2.5-1.23.1 php72-posix-7.2.5-1.23.1 php72-pspell-7.2.5-1.23.1 php72-readline-7.2.5-1.23.1 php72-shmop-7.2.5-1.23.1 php72-snmp-7.2.5-1.23.1 php72-soap-7.2.5-1.23.1 php72-sockets-7.2.5-1.23.1 php72-sqlite-7.2.5-1.23.1 php72-sysvmsg-7.2.5-1.23.1 php72-sysvsem-7.2.5-1.23.1 php72-sysvshm-7.2.5-1.23.1 php72-tidy-7.2.5-1.23.1 php72-tokenizer-7.2.5-1.23.1 php72-wddx-7.2.5-1.23.1 php72-xmlreader-7.2.5-1.23.1 php72-xmlrpc-7.2.5-1.23.1 php72-xmlwriter-7.2.5-1.23.1 php72-xsl-7.2.5-1.23.1 php72-zip-7.2.5-1.23.1 php72-zlib-7.2.5-1.23.1 apache2-mod_php72-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-bcmath-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-bz2-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-calendar-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-ctype-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-curl-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-dba-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-dom-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-enchant-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-exif-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-fastcgi-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-fileinfo-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-fpm-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-ftp-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-gd-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-gettext-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-gmp-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-iconv-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-imap-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-intl-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-json-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-ldap-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-mbstring-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-mysql-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-odbc-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-opcache-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-openssl-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-pcntl-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-pdo-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-pear-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-pear-Archive_Tar-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-pgsql-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-phar-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-posix-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-pspell-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-readline-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-shmop-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-snmp-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-soap-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-sockets-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-sqlite-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-sysvmsg-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-sysvsem-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-sysvshm-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-tidy-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-tokenizer-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-wddx-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-xmlreader-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-xmlrpc-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-xmlwriter-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-xsl-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-zip-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-zlib-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php72-devel-7.2.5-1.23.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash. CVE-2019-11041 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php72-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-bcmath-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-bz2-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-calendar-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ctype-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-curl-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-dba-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-dom-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-enchant-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-exif-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fastcgi-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fileinfo-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fpm-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ftp-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gd-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gettext-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gmp-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-iconv-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-imap-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-intl-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-json-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ldap-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-mbstring-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-mysql-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-odbc-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-opcache-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-openssl-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pcntl-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pdo-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pear-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pear-Archive_Tar-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pgsql-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-phar-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-posix-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pspell-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-readline-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-shmop-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-snmp-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-soap-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sockets-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sqlite-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvmsg-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvsem-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvshm-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-tidy-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-tokenizer-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-wddx-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlreader-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlrpc-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlwriter-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xsl-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-zip-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-zlib-7.2.5-1.23.1 SUSE Linux Enterprise Software Development Kit 12 SP4:php72-devel-7.2.5-1.23.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20192270-1/ https://www.suse.com/security/cve/CVE-2019-11041.html CVE-2019-11041 https://bugzilla.suse.com/1146360 SUSE Bug 1146360 When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash. CVE-2019-11042 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php72-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-bcmath-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-bz2-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-calendar-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ctype-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-curl-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-dba-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-dom-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-enchant-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-exif-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fastcgi-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fileinfo-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-fpm-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ftp-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gd-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gettext-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-gmp-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-iconv-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-imap-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-intl-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-json-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-ldap-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-mbstring-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-mysql-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-odbc-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-opcache-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-openssl-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pcntl-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pdo-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pear-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pear-Archive_Tar-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pgsql-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-phar-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-posix-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-pspell-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-readline-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-shmop-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-snmp-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-soap-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sockets-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sqlite-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvmsg-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvsem-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-sysvshm-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-tidy-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-tokenizer-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-wddx-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlreader-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlrpc-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xmlwriter-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-xsl-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-zip-7.2.5-1.23.1 SUSE Linux Enterprise Module for Web and Scripting 12:php72-zlib-7.2.5-1.23.1 SUSE Linux Enterprise Software Development Kit 12 SP4:php72-devel-7.2.5-1.23.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20192270-1/ https://www.suse.com/security/cve/CVE-2019-11042.html CVE-2019-11042 https://bugzilla.suse.com/1145095 SUSE Bug 1145095