Slackware Linux update for php

Published: 2014-09-05 | Updated: 2017-05-06

Risk	High
Patch available	YES
Number of vulnerabilities	7
CVE-ID	CVE-2014-2497 CVE-2014-3538 CVE-2014-3587 CVE-2014-3597 CVE-2014-4670 CVE-2014-4698 CVE-2014-5120
CWE-ID	CWE-476 CWE-20 CWE-190 CWE-119 CWE-416
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Slackware Linux Operating systems & Components / Operating system
Vendor	Slackware

Security Bulletin

This security bulletin contains information about 7 vulnerabilities.

1) NULL pointer dereference

EUVDB-ID: #VU33295

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2014-2497

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a crafted color table in an XPM file.

Mitigation

Update the affected package php.

Vulnerable software versions

Slackware Linux: 13.0 - 14.1

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2014&m=slackware-security.523796

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU32500

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2014-3538

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows remote attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule.

Mitigation

Update the affected package php.

Vulnerable software versions

Slackware Linux: 13.0 - 14.1

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2014&m=slackware-security.523796

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Integer overflow

EUVDB-ID: #VU3891

Risk: Low

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2014-3587

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16. A remote attacker can trigger memory corruption via a crafted CDF fileand cause the service to crash.

Mitigation

Update the affected package php.

Vulnerable software versions

Slackware Linux: 13.0 - 14.1

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2014&m=slackware-security.523796

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Buffer overflow

EUVDB-ID: #VU16096

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2014-3597

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16. A remote attacker can trigger memory corruption via a crafted DNS record, related to the dns_get_record function and the dn_expand function and cause the service to crash or execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package php.

Vulnerable software versions

Slackware Linux: 13.0 - 14.1

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2014&m=slackware-security.523796

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use-after-free

EUVDB-ID: #VU16093

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2014-4670

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition.

The vulnerability exists due to use-after-free error in ext/spl/spl_dllist.c in the SPL component in PHP through 5.5.14. A local attacker can trigger memory corruption via crafted iterator usage within applications in certain web-hosting environments and cause the service to crash.

Mitigation

Update the affected package php.

Vulnerable software versions

Slackware Linux: 13.0 - 14.1

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2014&m=slackware-security.523796

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use-after-free

EUVDB-ID: #VU16094

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2014-4698

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition.

The vulnerability exists due to use-after-free error in ext/spl/spl_array.c in the SPL component in PHP through 5.5.14. A local attacker can trigger memory corruption via crafted ArrayIterator usage within applications in certain web-hosting environments and cause the service to crash.

Mitigation

Update the affected package php.

Vulnerable software versions

Slackware Linux: 13.0 - 14.1

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2014&m=slackware-security.523796

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Input validation error

EUVDB-ID: #VU32501

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2014-5120

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.

gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function.

Mitigation

Update the affected package php.

Vulnerable software versions

Slackware Linux: 13.0 - 14.1

CPE2.3

External links

https://www.slackware.com/security/viewer.php?l=slackware-security&y=2014&m=slackware-security.523796

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.