ID

VAR-201506-0465


CVE

CVE-2015-3330


TITLE

PHP of sapi/apache2handler/sapi_apache2.c of php_handler Service disruption in functions (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2015-003047

DESCRIPTION

The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via pipelined HTTP requests that result in a "deconfigured interpreter.". PHP is prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts may result in a denial-of-service condition. PHP (PHP: Hypertext Preprocessor, PHP: Hypertext Preprocessor) is an open source general-purpose computer scripting language jointly maintained by the PHP Group and the open source community. The language is mainly used for Web development and supports a variety of databases and operating systems. The following versions are affected: PHP prior to 5.4.40, 5.5.x prior to 5.5.24, and 5.6.x prior to 5.6.8. ========================================================================== Ubuntu Security Notice USN-2572-1 April 20, 2015 php5 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.10 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS - Ubuntu 10.04 LTS Summary: Several security issues were fixed in PHP. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-2348) It was discovered that PHP incorrectly handled unserializing PHAR files. (CVE-2015-2787) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.10: libapache2-mod-php5 5.5.12+dfsg-2ubuntu4.4 php5-cgi 5.5.12+dfsg-2ubuntu4.4 php5-cli 5.5.12+dfsg-2ubuntu4.4 php5-fpm 5.5.12+dfsg-2ubuntu4.4 Ubuntu 14.04 LTS: libapache2-mod-php5 5.5.9+dfsg-1ubuntu4.9 php5-cgi 5.5.9+dfsg-1ubuntu4.9 php5-cli 5.5.9+dfsg-1ubuntu4.9 php5-fpm 5.5.9+dfsg-1ubuntu4.9 Ubuntu 12.04 LTS: libapache2-mod-php5 5.3.10-1ubuntu3.18 php5-cgi 5.3.10-1ubuntu3.18 php5-cli 5.3.10-1ubuntu3.18 php5-fpm 5.3.10-1ubuntu3.18 Ubuntu 10.04 LTS: libapache2-mod-php5 5.3.2-1ubuntu4.30 php5-cgi 5.3.2-1ubuntu4.30 php5-cli 5.3.2-1ubuntu4.30 In general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: php55-php security update Advisory ID: RHSA-2015:1186-01 Product: Red Hat Software Collections Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1186.html Issue date: 2015-06-25 CVE Names: CVE-2015-2783 CVE-2015-3307 CVE-2015-3329 CVE-2015-3330 CVE-2015-3411 CVE-2015-3412 CVE-2015-4021 CVE-2015-4022 CVE-2015-4024 CVE-2015-4025 CVE-2015-4026 CVE-2015-4598 CVE-2015-4602 CVE-2015-4603 CVE-2015-4604 CVE-2015-4605 ===================================================================== 1. Summary: Updated php55-php packages that fix multiple security issues are now available for Red Hat Software Collections 2. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.5) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. (CVE-2015-3330) A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024) An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. (CVE-2015-4022) Multiple flaws were discovered in the way PHP performed object unserialization. (CVE-2015-4602, CVE-2015-4603) It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-4025, CVE-2015-4026, CVE-2015-3411, CVE-2015-3412, CVE-2015-4598) Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened. (CVE-2015-2783, CVE-2015-3307, CVE-2015-3329, CVE-2015-4021) Multiple flaws were found in PHP's File Information (fileinfo) extension. A remote attacker could cause a PHP application to crash if it used fileinfo to identify type of attacker supplied files. (CVE-2015-4604, CVE-2015-4605) All php55-php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd24-httpd service must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1213394 - CVE-2015-3330 php: pipelined request executed in deinitialized interpreter under httpd 2.4 1213407 - CVE-2015-3411 php: missing null byte checks for paths in various PHP extensions 1213442 - CVE-2015-4604 CVE-2015-4605 php: denial of service when processing a crafted file with Fileinfo 1213446 - CVE-2015-2783 php: buffer over-read in Phar metadata parsing 1213449 - CVE-2015-3329 php: buffer overflow in phar_set_inode() 1222485 - CVE-2015-4024 php: multipart/form-data request paring CPU usage DoS 1223408 - CVE-2015-4025 php: CVE-2006-7243 regressions in 5.4+ 1223412 - CVE-2015-4022 php: integer overflow leading to heap overflow when reading FTP file listing 1223422 - CVE-2015-4026 php: pcntl_exec() accepts paths with NUL character 1223425 - CVE-2015-4021 php: memory corruption in phar_parse_tarfile caused by empty entry file name 1223441 - CVE-2015-3307 php: invalid pointer free() in phar_tar_process_metadata() 1232823 - CVE-2015-3412 php: missing null byte checks for paths in various PHP extensions 1232897 - CVE-2015-4598 php: missing null byte checks for paths in DOM and GD extensions 1232918 - CVE-2015-4603 php: exception::getTraceAsString type confusion issue after unserialize 1232923 - CVE-2015-4602 php: Incomplete Class unserialization type confusion 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6): Source: php55-php-5.5.21-4.el6.src.rpm x86_64: php55-php-5.5.21-4.el6.x86_64.rpm php55-php-bcmath-5.5.21-4.el6.x86_64.rpm php55-php-cli-5.5.21-4.el6.x86_64.rpm php55-php-common-5.5.21-4.el6.x86_64.rpm php55-php-dba-5.5.21-4.el6.x86_64.rpm php55-php-debuginfo-5.5.21-4.el6.x86_64.rpm php55-php-devel-5.5.21-4.el6.x86_64.rpm php55-php-enchant-5.5.21-4.el6.x86_64.rpm php55-php-fpm-5.5.21-4.el6.x86_64.rpm php55-php-gd-5.5.21-4.el6.x86_64.rpm php55-php-gmp-5.5.21-4.el6.x86_64.rpm php55-php-imap-5.5.21-4.el6.x86_64.rpm php55-php-intl-5.5.21-4.el6.x86_64.rpm php55-php-ldap-5.5.21-4.el6.x86_64.rpm php55-php-mbstring-5.5.21-4.el6.x86_64.rpm php55-php-mysqlnd-5.5.21-4.el6.x86_64.rpm php55-php-odbc-5.5.21-4.el6.x86_64.rpm php55-php-opcache-5.5.21-4.el6.x86_64.rpm php55-php-pdo-5.5.21-4.el6.x86_64.rpm php55-php-pgsql-5.5.21-4.el6.x86_64.rpm php55-php-process-5.5.21-4.el6.x86_64.rpm php55-php-pspell-5.5.21-4.el6.x86_64.rpm php55-php-recode-5.5.21-4.el6.x86_64.rpm php55-php-snmp-5.5.21-4.el6.x86_64.rpm php55-php-soap-5.5.21-4.el6.x86_64.rpm php55-php-tidy-5.5.21-4.el6.x86_64.rpm php55-php-xml-5.5.21-4.el6.x86_64.rpm php55-php-xmlrpc-5.5.21-4.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.5): Source: php55-php-5.5.21-4.el6.src.rpm x86_64: php55-php-5.5.21-4.el6.x86_64.rpm php55-php-bcmath-5.5.21-4.el6.x86_64.rpm php55-php-cli-5.5.21-4.el6.x86_64.rpm php55-php-common-5.5.21-4.el6.x86_64.rpm php55-php-dba-5.5.21-4.el6.x86_64.rpm php55-php-debuginfo-5.5.21-4.el6.x86_64.rpm php55-php-devel-5.5.21-4.el6.x86_64.rpm php55-php-enchant-5.5.21-4.el6.x86_64.rpm php55-php-fpm-5.5.21-4.el6.x86_64.rpm php55-php-gd-5.5.21-4.el6.x86_64.rpm php55-php-gmp-5.5.21-4.el6.x86_64.rpm php55-php-imap-5.5.21-4.el6.x86_64.rpm php55-php-intl-5.5.21-4.el6.x86_64.rpm php55-php-ldap-5.5.21-4.el6.x86_64.rpm php55-php-mbstring-5.5.21-4.el6.x86_64.rpm php55-php-mysqlnd-5.5.21-4.el6.x86_64.rpm php55-php-odbc-5.5.21-4.el6.x86_64.rpm php55-php-opcache-5.5.21-4.el6.x86_64.rpm php55-php-pdo-5.5.21-4.el6.x86_64.rpm php55-php-pgsql-5.5.21-4.el6.x86_64.rpm php55-php-process-5.5.21-4.el6.x86_64.rpm php55-php-pspell-5.5.21-4.el6.x86_64.rpm php55-php-recode-5.5.21-4.el6.x86_64.rpm php55-php-snmp-5.5.21-4.el6.x86_64.rpm php55-php-soap-5.5.21-4.el6.x86_64.rpm php55-php-tidy-5.5.21-4.el6.x86_64.rpm php55-php-xml-5.5.21-4.el6.x86_64.rpm php55-php-xmlrpc-5.5.21-4.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6): Source: php55-php-5.5.21-4.el6.src.rpm x86_64: php55-php-5.5.21-4.el6.x86_64.rpm php55-php-bcmath-5.5.21-4.el6.x86_64.rpm php55-php-cli-5.5.21-4.el6.x86_64.rpm php55-php-common-5.5.21-4.el6.x86_64.rpm php55-php-dba-5.5.21-4.el6.x86_64.rpm php55-php-debuginfo-5.5.21-4.el6.x86_64.rpm php55-php-devel-5.5.21-4.el6.x86_64.rpm php55-php-enchant-5.5.21-4.el6.x86_64.rpm php55-php-fpm-5.5.21-4.el6.x86_64.rpm php55-php-gd-5.5.21-4.el6.x86_64.rpm php55-php-gmp-5.5.21-4.el6.x86_64.rpm php55-php-imap-5.5.21-4.el6.x86_64.rpm php55-php-intl-5.5.21-4.el6.x86_64.rpm php55-php-ldap-5.5.21-4.el6.x86_64.rpm php55-php-mbstring-5.5.21-4.el6.x86_64.rpm php55-php-mysqlnd-5.5.21-4.el6.x86_64.rpm php55-php-odbc-5.5.21-4.el6.x86_64.rpm php55-php-opcache-5.5.21-4.el6.x86_64.rpm php55-php-pdo-5.5.21-4.el6.x86_64.rpm php55-php-pgsql-5.5.21-4.el6.x86_64.rpm php55-php-process-5.5.21-4.el6.x86_64.rpm php55-php-pspell-5.5.21-4.el6.x86_64.rpm php55-php-recode-5.5.21-4.el6.x86_64.rpm php55-php-snmp-5.5.21-4.el6.x86_64.rpm php55-php-soap-5.5.21-4.el6.x86_64.rpm php55-php-tidy-5.5.21-4.el6.x86_64.rpm php55-php-xml-5.5.21-4.el6.x86_64.rpm php55-php-xmlrpc-5.5.21-4.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6): Source: php55-php-5.5.21-4.el6.src.rpm x86_64: php55-php-5.5.21-4.el6.x86_64.rpm php55-php-bcmath-5.5.21-4.el6.x86_64.rpm php55-php-cli-5.5.21-4.el6.x86_64.rpm php55-php-common-5.5.21-4.el6.x86_64.rpm php55-php-dba-5.5.21-4.el6.x86_64.rpm php55-php-debuginfo-5.5.21-4.el6.x86_64.rpm php55-php-devel-5.5.21-4.el6.x86_64.rpm php55-php-enchant-5.5.21-4.el6.x86_64.rpm php55-php-fpm-5.5.21-4.el6.x86_64.rpm php55-php-gd-5.5.21-4.el6.x86_64.rpm php55-php-gmp-5.5.21-4.el6.x86_64.rpm php55-php-imap-5.5.21-4.el6.x86_64.rpm php55-php-intl-5.5.21-4.el6.x86_64.rpm php55-php-ldap-5.5.21-4.el6.x86_64.rpm php55-php-mbstring-5.5.21-4.el6.x86_64.rpm php55-php-mysqlnd-5.5.21-4.el6.x86_64.rpm php55-php-odbc-5.5.21-4.el6.x86_64.rpm php55-php-opcache-5.5.21-4.el6.x86_64.rpm php55-php-pdo-5.5.21-4.el6.x86_64.rpm php55-php-pgsql-5.5.21-4.el6.x86_64.rpm php55-php-process-5.5.21-4.el6.x86_64.rpm php55-php-pspell-5.5.21-4.el6.x86_64.rpm php55-php-recode-5.5.21-4.el6.x86_64.rpm php55-php-snmp-5.5.21-4.el6.x86_64.rpm php55-php-soap-5.5.21-4.el6.x86_64.rpm php55-php-tidy-5.5.21-4.el6.x86_64.rpm php55-php-xml-5.5.21-4.el6.x86_64.rpm php55-php-xmlrpc-5.5.21-4.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: php55-php-5.5.21-4.el7.src.rpm x86_64: php55-php-5.5.21-4.el7.x86_64.rpm php55-php-bcmath-5.5.21-4.el7.x86_64.rpm php55-php-cli-5.5.21-4.el7.x86_64.rpm php55-php-common-5.5.21-4.el7.x86_64.rpm php55-php-dba-5.5.21-4.el7.x86_64.rpm php55-php-debuginfo-5.5.21-4.el7.x86_64.rpm php55-php-devel-5.5.21-4.el7.x86_64.rpm php55-php-enchant-5.5.21-4.el7.x86_64.rpm php55-php-fpm-5.5.21-4.el7.x86_64.rpm php55-php-gd-5.5.21-4.el7.x86_64.rpm php55-php-gmp-5.5.21-4.el7.x86_64.rpm php55-php-intl-5.5.21-4.el7.x86_64.rpm php55-php-ldap-5.5.21-4.el7.x86_64.rpm php55-php-mbstring-5.5.21-4.el7.x86_64.rpm php55-php-mysqlnd-5.5.21-4.el7.x86_64.rpm php55-php-odbc-5.5.21-4.el7.x86_64.rpm php55-php-opcache-5.5.21-4.el7.x86_64.rpm php55-php-pdo-5.5.21-4.el7.x86_64.rpm php55-php-pgsql-5.5.21-4.el7.x86_64.rpm php55-php-process-5.5.21-4.el7.x86_64.rpm php55-php-pspell-5.5.21-4.el7.x86_64.rpm php55-php-recode-5.5.21-4.el7.x86_64.rpm php55-php-snmp-5.5.21-4.el7.x86_64.rpm php55-php-soap-5.5.21-4.el7.x86_64.rpm php55-php-xml-5.5.21-4.el7.x86_64.rpm php55-php-xmlrpc-5.5.21-4.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1): Source: php55-php-5.5.21-4.el7.src.rpm x86_64: php55-php-5.5.21-4.el7.x86_64.rpm php55-php-bcmath-5.5.21-4.el7.x86_64.rpm php55-php-cli-5.5.21-4.el7.x86_64.rpm php55-php-common-5.5.21-4.el7.x86_64.rpm php55-php-dba-5.5.21-4.el7.x86_64.rpm php55-php-debuginfo-5.5.21-4.el7.x86_64.rpm php55-php-devel-5.5.21-4.el7.x86_64.rpm php55-php-enchant-5.5.21-4.el7.x86_64.rpm php55-php-fpm-5.5.21-4.el7.x86_64.rpm php55-php-gd-5.5.21-4.el7.x86_64.rpm php55-php-gmp-5.5.21-4.el7.x86_64.rpm php55-php-intl-5.5.21-4.el7.x86_64.rpm php55-php-ldap-5.5.21-4.el7.x86_64.rpm php55-php-mbstring-5.5.21-4.el7.x86_64.rpm php55-php-mysqlnd-5.5.21-4.el7.x86_64.rpm php55-php-odbc-5.5.21-4.el7.x86_64.rpm php55-php-opcache-5.5.21-4.el7.x86_64.rpm php55-php-pdo-5.5.21-4.el7.x86_64.rpm php55-php-pgsql-5.5.21-4.el7.x86_64.rpm php55-php-process-5.5.21-4.el7.x86_64.rpm php55-php-pspell-5.5.21-4.el7.x86_64.rpm php55-php-recode-5.5.21-4.el7.x86_64.rpm php55-php-snmp-5.5.21-4.el7.x86_64.rpm php55-php-soap-5.5.21-4.el7.x86_64.rpm php55-php-xml-5.5.21-4.el7.x86_64.rpm php55-php-xmlrpc-5.5.21-4.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: php55-php-5.5.21-4.el7.src.rpm x86_64: php55-php-5.5.21-4.el7.x86_64.rpm php55-php-bcmath-5.5.21-4.el7.x86_64.rpm php55-php-cli-5.5.21-4.el7.x86_64.rpm php55-php-common-5.5.21-4.el7.x86_64.rpm php55-php-dba-5.5.21-4.el7.x86_64.rpm php55-php-debuginfo-5.5.21-4.el7.x86_64.rpm php55-php-devel-5.5.21-4.el7.x86_64.rpm php55-php-enchant-5.5.21-4.el7.x86_64.rpm php55-php-fpm-5.5.21-4.el7.x86_64.rpm php55-php-gd-5.5.21-4.el7.x86_64.rpm php55-php-gmp-5.5.21-4.el7.x86_64.rpm php55-php-intl-5.5.21-4.el7.x86_64.rpm php55-php-ldap-5.5.21-4.el7.x86_64.rpm php55-php-mbstring-5.5.21-4.el7.x86_64.rpm php55-php-mysqlnd-5.5.21-4.el7.x86_64.rpm php55-php-odbc-5.5.21-4.el7.x86_64.rpm php55-php-opcache-5.5.21-4.el7.x86_64.rpm php55-php-pdo-5.5.21-4.el7.x86_64.rpm php55-php-pgsql-5.5.21-4.el7.x86_64.rpm php55-php-process-5.5.21-4.el7.x86_64.rpm php55-php-pspell-5.5.21-4.el7.x86_64.rpm php55-php-recode-5.5.21-4.el7.x86_64.rpm php55-php-snmp-5.5.21-4.el7.x86_64.rpm php55-php-soap-5.5.21-4.el7.x86_64.rpm php55-php-xml-5.5.21-4.el7.x86_64.rpm php55-php-xmlrpc-5.5.21-4.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-2783 https://access.redhat.com/security/cve/CVE-2015-3307 https://access.redhat.com/security/cve/CVE-2015-3329 https://access.redhat.com/security/cve/CVE-2015-3330 https://access.redhat.com/security/cve/CVE-2015-3411 https://access.redhat.com/security/cve/CVE-2015-3412 https://access.redhat.com/security/cve/CVE-2015-4021 https://access.redhat.com/security/cve/CVE-2015-4022 https://access.redhat.com/security/cve/CVE-2015-4024 https://access.redhat.com/security/cve/CVE-2015-4025 https://access.redhat.com/security/cve/CVE-2015-4026 https://access.redhat.com/security/cve/CVE-2015-4598 https://access.redhat.com/security/cve/CVE-2015-4602 https://access.redhat.com/security/cve/CVE-2015-4603 https://access.redhat.com/security/cve/CVE-2015-4604 https://access.redhat.com/security/cve/CVE-2015-4605 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVi8HYXlSAg2UNWIIRAiyPAJ99IZMPIkUJWe8WmApDpEGV6ff98wCgxBYL TtBX6SWqx78H/4bsQXtRlo4= =EuyB -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Here are the details from the Slackware 14.1 ChangeLog: +--------------------------+ patches/packages/php-5.4.40-i486-1_slack14.1.txz: Upgraded. Please note that this package build also moves the configuration files from /etc/httpd to /etc, /etc/php.d, and /etc/php-fpm.d. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9709 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0231 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1351 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1352 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2301 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2305 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2331 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2783 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3330 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you. Updated package for Slackware 14.0: ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/php-5.4.40-i486-1_slack14.0.txz Updated package for Slackware x86_64 14.0: ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/php-5.4.40-x86_64-1_slack14.0.txz Updated package for Slackware 14.1: ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/php-5.4.40-i486-1_slack14.1.txz Updated package for Slackware x86_64 14.1: ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/php-5.4.40-x86_64-1_slack14.1.txz Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/php-5.6.8-i486-1.txz Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/php-5.6.8-x86_64-1.txz MD5 signatures: +-------------+ Slackware 14.0 package: 2666059d6540b1b4385d25dfc5ebbe99 php-5.4.40-i486-1_slack14.0.txz Slackware x86_64 14.0 package: c146f500912ba9c7e5d652e5e3643c04 php-5.4.40-x86_64-1_slack14.0.txz Slackware 14.1 package: 9efc8a96f9a3f3261e5f640292b1b781 php-5.4.40-i486-1_slack14.1.txz Slackware x86_64 14.1 package: 2c95e077f314f1cfa3ee83b9aba90b91 php-5.4.40-x86_64-1_slack14.1.txz Slackware -current package: 30d14f237c71fada0d594c2360a58016 n/php-5.6.8-i486-1.txz Slackware x86_64 -current package: 1a0fcc590aa4dff5de5f08293936d0d9 n/php-5.6.8-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg php-5.4.40-i486-1_slack14.1.txz Then, restart Apache httpd: # /etc/rc.d/rc.httpd stop # /etc/rc.d/rc.httpd start +-----+ Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com +------------------------------------------------------------------------+ | To leave the slackware-security mailing list: | +------------------------------------------------------------------------+ | Send an email to majordomo@slackware.com with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back containing instructions to | | complete the process. Please do not reply to this email address. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201606-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: PHP: Multiple vulnerabilities Date: June 19, 2016 Bugs: #537586, #541098, #544186, #544330, #546872, #549538, #552408, #555576, #555830, #556952, #559612, #562882, #571254, #573892, #577376 ID: 201606-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in PHP, the worst of which could lead to arbitrary code execution, or cause a Denial of Service condition. Background ========== PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All PHP 5.4 users should upgrade to the latest 5.5 stable branch, as PHP 5.4 is now masked in Portage: # emerge --sync # emerge --ask --oneshot --verbose ">=dev=lang/php-5.5.33" All PHP 5.5 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev=lang/php-5.5.33" All PHP 5.6 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev=lang/php-5.6.19" References ========== [ 1 ] CVE-2013-6501 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6501 [ 2 ] CVE-2014-9705 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9705 [ 3 ] CVE-2014-9709 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9709 [ 4 ] CVE-2015-0231 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0231 [ 5 ] CVE-2015-0273 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0273 [ 6 ] CVE-2015-1351 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1351 [ 7 ] CVE-2015-1352 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1352 [ 8 ] CVE-2015-2301 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2301 [ 9 ] CVE-2015-2348 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2348 [ 10 ] CVE-2015-2783 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2783 [ 11 ] CVE-2015-2787 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2787 [ 12 ] CVE-2015-3329 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3329 [ 13 ] CVE-2015-3330 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-3330 [ 14 ] CVE-2015-4021 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4021 [ 15 ] CVE-2015-4022 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4022 [ 16 ] CVE-2015-4025 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4025 [ 17 ] CVE-2015-4026 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4026 [ 18 ] CVE-2015-4147 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4147 [ 19 ] CVE-2015-4148 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4148 [ 20 ] CVE-2015-4642 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4642 [ 21 ] CVE-2015-4643 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4643 [ 22 ] CVE-2015-4644 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4644 [ 23 ] CVE-2015-6831 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-6831 [ 24 ] CVE-2015-6832 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-6832 [ 25 ] CVE-2015-6833 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-6833 [ 26 ] CVE-2015-6834 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-6834 [ 27 ] CVE-2015-6835 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-6835 [ 28 ] CVE-2015-6836 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-6836 [ 29 ] CVE-2015-6837 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-6837 [ 30 ] CVE-2015-6838 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-6838 [ 31 ] CVE-2015-7803 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7803 [ 32 ] CVE-2015-7804 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7804 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201606-10 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2016 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . Buffer Overflow when parsing tar/zip/phar in phar_set_inode (CVE-2015-3329). Potential remote code execution with apache 2.4 apache2handler (CVE-2015-3330). PHP has been updated to version 5.5.24, which fixes these issues and other bugs. Additionally the timezonedb packages has been upgraded to the latest version and the PECL packages which requires so has been rebuilt for php-5.5.24. The verification of md5 checksums and GPG signatures is performed automatically for you. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFVPf25mqjQ0CJFipgRAr9DAJwLXVXZqUb2kRGPCR9arVb7TKkfOQCgmCY7 cUUPvfG5XP6mbL/c94A8wq0= =BCBr -----END PGP SIGNATURE-----

Trust: 2.61

sources: NVD: CVE-2015-3330 // JVNDB: JVNDB-2015-003047 // BID: 74204 // VULHUB: VHN-81291 // VULMON: CVE-2015-3330 // PACKETSTORM: 131528 // PACKETSTORM: 132440 // PACKETSTORM: 131577 // PACKETSTORM: 132442 // PACKETSTORM: 137539 // PACKETSTORM: 131640

AFFECTED PRODUCTS

vendor:phpmodel:phpscope:eqversion:5.6.7

Trust: 1.6

vendor:phpmodel:phpscope:eqversion:5.6.0

Trust: 1.6

vendor:phpmodel:phpscope:eqversion:5.5.9

Trust: 1.6

vendor:phpmodel:phpscope:eqversion:5.6.5

Trust: 1.6

vendor:phpmodel:phpscope:eqversion:5.5.13

Trust: 1.6

vendor:phpmodel:phpscope:eqversion:5.5.0

Trust: 1.6

vendor:redhatmodel:enterprise linuxscope:eqversion:7.0

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.5.14

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.5.23

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.5.1

Trust: 1.0

vendor:redhatmodel:enterprise linuxscope:eqversion:6.0

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.5.12

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.5.3

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.5.19

Trust: 1.0

vendor:redhatmodel:enterprise linux server eusscope:eqversion:7.1

Trust: 1.0

vendor:redhatmodel:enterprise linux serverscope:eqversion:7.0

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.5.2

Trust: 1.0

vendor:redhatmodel:enterprise linux hpc nodescope:eqversion:7.0

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.5.5

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.6.6

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.5.22

Trust: 1.0

vendor:redhatmodel:enterprise linux workstationscope:eqversion:7.0

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.5.10

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.5.18

Trust: 1.0

vendor:oraclemodel:linuxscope:eqversion:6

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.5.7

Trust: 1.0

vendor:oraclemodel:solarisscope:eqversion:11.2

Trust: 1.0

vendor:oraclemodel:linuxscope:eqversion:7

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.5.11

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.5.8

Trust: 1.0

vendor:redhatmodel:enterprise linux desktopscope:eqversion:7.0

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.5.6

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.6.4

Trust: 1.0

vendor:redhatmodel:enterprise linux hpc node eusscope:eqversion:7.1

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.5.20

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.6.2

Trust: 1.0

vendor:phpmodel:phpscope:lteversion:5.4.39

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.6.3

Trust: 1.0

vendor:applemodel:mac os xscope:lteversion:10.10.4

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.5.4

Trust: 1.0

vendor:phpmodel:phpscope:eqversion:5.5.21

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.9.5 (ht205031)

Trust: 0.8

vendor:the php groupmodel:phpscope:eqversion:5.5.24

Trust: 0.8

vendor:applemodel:mac os xscope:eqversion:10.6.8 thats all 10.11

Trust: 0.8

vendor:the php groupmodel:phpscope:ltversion:5.6.x

Trust: 0.8

vendor:applemodel:mac os xscope:ltversion:(ht205267)

Trust: 0.8

vendor:the php groupmodel:phpscope:eqversion:5.6.8

Trust: 0.8

vendor:the php groupmodel:phpscope:ltversion:5.5.x

Trust: 0.8

vendor:applemodel:mac os xscope:eqversion:10.10 to 10.10.4 (ht205031)

Trust: 0.8

vendor:ubuntumodel:linux lts i386scope:eqversion:12.04

Trust: 0.3

vendor:ubuntumodel:linux lts amd64scope:eqversion:12.04

Trust: 0.3

vendor:ubuntumodel:linux sparcscope:eqversion:10.04

Trust: 0.3

vendor:ubuntumodel:linux powerpcscope:eqversion:10.04

Trust: 0.3

vendor:ubuntumodel:linux i386scope:eqversion:10.04

Trust: 0.3

vendor:ubuntumodel:linux armscope:eqversion:10.04

Trust: 0.3

vendor:ubuntumodel:linux amd64scope:eqversion:10.04

Trust: 0.3

vendor:phpmodel:phpscope:eqversion:5.4.3

Trust: 0.3

vendor:phpmodel:phpscope:eqversion:5.4.2

Trust: 0.3

vendor:phpmodel:phpscope:eqversion:5.4.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.7.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.7.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.7.1

Trust: 0.3

sources: BID: 74204 // JVNDB: JVNDB-2015-003047 // CNNVD: CNNVD-201505-042 // NVD: CVE-2015-3330

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-3330
value: MEDIUM

Trust: 1.0

NVD: CVE-2015-3330
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201505-042
value: MEDIUM

Trust: 0.6

VULHUB: VHN-81291
value: MEDIUM

Trust: 0.1

VULMON: CVE-2015-3330
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2015-3330
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-81291
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-81291 // VULMON: CVE-2015-3330 // JVNDB: JVNDB-2015-003047 // CNNVD: CNNVD-201505-042 // NVD: CVE-2015-3330

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-81291 // JVNDB: JVNDB-2015-003047 // NVD: CVE-2015-3330

THREAT TYPE

remote

Trust: 0.9

sources: PACKETSTORM: 131528 // PACKETSTORM: 132440 // PACKETSTORM: 132442 // CNNVD: CNNVD-201505-042

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201505-042

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-003047

PATCH

title:APPLE-SA-2015-09-30-3 OS X El Capitan 10.11url:http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html

Trust: 0.8

title:APPLE-SA-2015-08-13-2 OS X Yosemite v10.10.5 and Security Update 2015-006url:http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html

Trust: 0.8

title:HT205267url:https://support.apple.com/en-us/HT205267

Trust: 0.8

title:HT205031url:https://support.apple.com/en-us/HT205031

Trust: 0.8

title:HT205031url:https://support.apple.com/ja-jp/HT205031

Trust: 0.8

title:HT205267url:http://support.apple.com/ja-jp/HT205267

Trust: 0.8

title:Sec Bug #69218url:https://bugs.php.net/bug.php?id=69218

Trust: 0.8

title:PHP 5 ChangeLogurl:http://php.net/ChangeLog-5.php

Trust: 0.8

title:Fix bug #68486 and bug #69218 (segfault in apache2handler with apache 2.4)url:http://git.php.net/?p=php-src.git;a=commit;h=809610f5ea38a83b284e1125d1fff129bdd615e7

Trust: 0.8

title:TLSA-2015-15url:http://www.turbolinux.co.jp/security/2015/TLSA-2015-15j.html

Trust: 0.8

title:Red Hat: CVE-2015-3330url:https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database&qid=CVE-2015-3330

Trust: 0.1

title:Ubuntu Security Notice: php5 vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-2572-1

Trust: 0.1

title:Apple: OS X El Capitan v10.11url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=e88bab658248444f5dffc23fd95859e7

Trust: 0.1

title:Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - July 2015url:https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins&qid=8b701aba68029ec36b631a8e26157a22

Trust: 0.1

title:Apple: OS X Yosemite v10.10.5 and Security Update 2015-006url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=9834d0d73bf28fb80d3390930bafd906

Trust: 0.1

title:Oracle Linux Bulletins: Oracle Linux Bulletin - January 2016url:https://vulmon.com/vendoradvisory?qidtp=oracle_linux_bulletins&qid=8ad80411af3e936eb2998df70506cc71

Trust: 0.1

sources: VULMON: CVE-2015-3330 // JVNDB: JVNDB-2015-003047

EXTERNAL IDS

db:NVDid:CVE-2015-3330

Trust: 3.5

db:BIDid:74204

Trust: 2.1

db:SECTRACKid:1033703

Trust: 1.8

db:OPENWALLid:OSS-SECURITY/2015/04/17/7

Trust: 1.8

db:JVNid:JVNVU97220341

Trust: 0.8

db:JVNid:JVNVU94440136

Trust: 0.8

db:JVNDBid:JVNDB-2015-003047

Trust: 0.8

db:CNNVDid:CNNVD-201505-042

Trust: 0.7

db:VULHUBid:VHN-81291

Trust: 0.1

db:VULMONid:CVE-2015-3330

Trust: 0.1

db:PACKETSTORMid:131528

Trust: 0.1

db:PACKETSTORMid:132440

Trust: 0.1

db:PACKETSTORMid:131577

Trust: 0.1

db:PACKETSTORMid:132442

Trust: 0.1

db:PACKETSTORMid:137539

Trust: 0.1

db:PACKETSTORMid:131640

Trust: 0.1

sources: VULHUB: VHN-81291 // VULMON: CVE-2015-3330 // BID: 74204 // JVNDB: JVNDB-2015-003047 // PACKETSTORM: 131528 // PACKETSTORM: 132440 // PACKETSTORM: 131577 // PACKETSTORM: 132442 // PACKETSTORM: 137539 // PACKETSTORM: 131640 // CNNVD: CNNVD-201505-042 // NVD: CVE-2015-3330

REFERENCES

url:http://www.securityfocus.com/bid/74204

Trust: 2.4

url:https://security.gentoo.org/glsa/201606-10

Trust: 1.9

url:http://rhn.redhat.com/errata/rhsa-2015-1186.html

Trust: 1.9

url:http://rhn.redhat.com/errata/rhsa-2015-1187.html

Trust: 1.9

url:http://www.ubuntu.com/usn/usn-2572-1

Trust: 1.9

url:http://lists.apple.com/archives/security-announce/2015/aug/msg00001.html

Trust: 1.8

url:http://lists.apple.com/archives/security-announce/2015/sep/msg00008.html

Trust: 1.8

url:http://php.net/changelog-5.php

Trust: 1.8

url:http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html

Trust: 1.8

url:http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

Trust: 1.8

url:https://bugs.php.net/bug.php?id=68486

Trust: 1.8

url:https://bugs.php.net/bug.php?id=69218

Trust: 1.8

url:https://support.apple.com/ht205267

Trust: 1.8

url:https://support.apple.com/kb/ht205031

Trust: 1.8

url:http://openwall.com/lists/oss-security/2015/04/17/7

Trust: 1.8

url:http://rhn.redhat.com/errata/rhsa-2015-1066.html

Trust: 1.8

url:http://rhn.redhat.com/errata/rhsa-2015-1135.html

Trust: 1.8

url:http://www.securitytracker.com/id/1033703

Trust: 1.8

url:http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.html

Trust: 1.8

url:http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00004.html

Trust: 1.8

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-3330

Trust: 1.0

url:http://git.php.net/?p=php-src.git%3ba=commit%3bh=809610f5ea38a83b284e1125d1fff129bdd615e7

Trust: 1.0

url:http://git.php.net/?p=php-src.git;a=commit;h=809610f5ea38a83b284e1125d1fff129bdd615e7

Trust: 0.8

url:http://jvn.jp/vu/jvnvu94440136/index.html

Trust: 0.8

url:http://jvn.jp/vu/jvnvu97220341/index.html

Trust: 0.8

url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-3330

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2015-3330

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2015-2783

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2015-3329

Trust: 0.5

url:https://access.redhat.com/security/cve/cve-2015-3330

Trust: 0.3

url:http://www.php.net/

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2015-4021

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2015-4025

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2015-4026

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2015-4022

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2015-2305

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-2348

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-2787

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-3411

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-4605

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-4603

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-4024

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-4604

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-4021

Trust: 0.2

url:https://access.redhat.com/security/updates/classification/#important

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-3307

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-3411

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-4022

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-2783

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-3412

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-4602

Trust: 0.2

url:https://access.redhat.com/articles/11258

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-3307

Trust: 0.2

url:https://access.redhat.com/security/team/contact/

Trust: 0.2

url:https://www.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-4026

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-3412

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-4598

Trust: 0.2

url:https://bugzilla.redhat.com/):

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-4024

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-4602

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-4604

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-3329

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-4598

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-4605

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-4603

Trust: 0.2

url:https://access.redhat.com/security/cve/cve-2015-4025

Trust: 0.2

url:https://access.redhat.com/security/team/key/

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-0231

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-1351

Trust: 0.2

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-2783

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-1352

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-2301

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2014-9709

Trust: 0.2

url:https://cwe.mitre.org/data/definitions/20.html

Trust: 0.1

url:http://tools.cisco.com/security/center/viewalert.x?alertid=39488

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://usn.ubuntu.com/2572-1/

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/php5/5.5.12+dfsg-2ubuntu4.4

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/php5/5.3.2-1ubuntu4.30

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/php5/5.5.9+dfsg-1ubuntu4.9

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.18

Trust: 0.1

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-2305

Trust: 0.1

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-2301

Trust: 0.1

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-9709

Trust: 0.1

url:http://slackware.com

Trust: 0.1

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-2331

Trust: 0.1

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-1351

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-2331

Trust: 0.1

url:http://slackware.com/gpg-key

Trust: 0.1

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-0231

Trust: 0.1

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-1352

Trust: 0.1

url:http://osuosl.org)

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-2301

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-4148

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-1352

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-2348

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-4022

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-6836

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-4147

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-9709

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-4026

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-6836

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-6831

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-0273

Trust: 0.1

url:https://security.gentoo.org/

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-4021

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-7804

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-4643

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2013-6501

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-6834

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-4644

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-6835

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-4642

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-9705

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-6832

Trust: 0.1

url:http://creativecommons.org/licenses/by-sa/2.5

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-6832

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-6831

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-6835

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-3330

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-4643

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-6838

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-4642

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-2787

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-4148

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-6501

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-4147

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-2783

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-3329

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-7803

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-6837

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-1351

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-0273

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-6833

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-4025

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-4644

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-9705

Trust: 0.1

url:https://bugs.gentoo.org.

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-6834

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2015-0231

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-6833

Trust: 0.1

url:http://www.mandriva.com/en/support/security/

Trust: 0.1

url:http://www.mandriva.com/en/support/security/advisories/

Trust: 0.1

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-3329

Trust: 0.1

url:http://advisories.mageia.org/mgasa-2015-0169.html

Trust: 0.1

sources: VULHUB: VHN-81291 // VULMON: CVE-2015-3330 // BID: 74204 // JVNDB: JVNDB-2015-003047 // PACKETSTORM: 131528 // PACKETSTORM: 132440 // PACKETSTORM: 131577 // PACKETSTORM: 132442 // PACKETSTORM: 137539 // PACKETSTORM: 131640 // CNNVD: CNNVD-201505-042 // NVD: CVE-2015-3330

CREDITS

php@bof.de

Trust: 0.3

sources: BID: 74204

SOURCES

db:VULHUBid:VHN-81291
db:VULMONid:CVE-2015-3330
db:BIDid:74204
db:JVNDBid:JVNDB-2015-003047
db:PACKETSTORMid:131528
db:PACKETSTORMid:132440
db:PACKETSTORMid:131577
db:PACKETSTORMid:132442
db:PACKETSTORMid:137539
db:PACKETSTORMid:131640
db:CNNVDid:CNNVD-201505-042
db:NVDid:CVE-2015-3330

LAST UPDATE DATE

2025-04-25T21:37:07.361000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-81291date:2019-12-27T00:00:00
db:VULMONid:CVE-2015-3330date:2019-12-27T00:00:00
db:BIDid:74204date:2016-07-05T21:28:00
db:JVNDBid:JVNDB-2015-003047date:2015-10-06T00:00:00
db:CNNVDid:CNNVD-201505-042date:2019-12-30T00:00:00
db:NVDid:CVE-2015-3330date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE

db:VULHUBid:VHN-81291date:2015-06-09T00:00:00
db:VULMONid:CVE-2015-3330date:2015-06-09T00:00:00
db:BIDid:74204date:2015-04-17T00:00:00
db:JVNDBid:JVNDB-2015-003047date:2015-06-12T00:00:00
db:PACKETSTORMid:131528date:2015-04-20T19:22:00
db:PACKETSTORMid:132440date:2015-06-25T14:18:12
db:PACKETSTORMid:131577date:2015-04-22T20:14:00
db:PACKETSTORMid:132442date:2015-06-25T14:18:25
db:PACKETSTORMid:137539date:2016-06-19T15:55:00
db:PACKETSTORMid:131640date:2015-04-27T16:21:20
db:CNNVDid:CNNVD-201505-042date:2015-04-27T00:00:00
db:NVDid:CVE-2015-3330date:2015-06-09T18:59:03.613