SB2017070604 - Multiple vulnerabilities in PHP

Security Bulletin ID SB2017070604

Severity

High

Patch available

YES

Number of vulnerabilities 14

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 14 secuirty vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2017-9224)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists in the mbstring due to stack out-of-bounds read in match_at() during regular expression searching. A remote attacker can trigger a logical error involving order of validation and access in match_at() and read arbitrary files on the system.

Successful exploitation of the vulnerability results in information disclosure.

2) Heap-out-of-bounds write (CVE-ID: CVE-2017-9226)

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists in the mbstring due to heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. A remote attacker can supply a malformed regular expression containing an octal number in the form of '\700', trigger
out-of-bounds write memory corruption and execute arbitrary code with web server privileges.

Successful exploitation of the vulnerability may result in system compromise.

3) Out-of-bounds read (CVE-ID: CVE-2017-9227)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists in the mbstring due to an error in handling of reg->dmin in forward_search_range(). A remote attacker can trigger stack out-of-bounds read in mbc_enc_len() during regular expression searching and read arbitrary files on the system.

Successful exploitation of the vulnerability results in information disclosure.

4) Heap-out-of-bounds write (CVE-ID: CVE-2017-9228)

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists in the mbstring due to heap out-of-bounds write in bitset_set_range() during regular expression compilation due to incorrect state transition in parse_char_class(). A remote attacker can trigger out-of-bounds write memory corruption and execute arbitrary code with web server privileges.

Successful exploitation of the vulnerability may result in system compromise.

5) Null pointer dereference (CVE-ID: CVE-2017-9229)

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists in the mbstring due to an error in handling of reg->dmin in forward_search_range(). A remote attacker can trigger SIGSEGV in left_adjust_char_head() during regular expression compilation, cause NULL pointer dereference and the application to crash.

Successful exploitation of the vulnerability results in denial of service.

6) Heap-based buffer overflow (CVE-ID: N/A)

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists due to heap-based buffer overflow in substr'swhen handling malicious input. A remote attacker can send specially crafted parameter to trigger memory corruption and execute arbitrary code with web server privileges.

Successful exploitation of the vulnerability may result in system compromise.

7) Improper access control (CVE-ID: N/A)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to improper access control. A remote attacker can use negative offset parameter and a big string haystack to gain illegal memory access in zend_memnstr_ex function and read arbitrary files on the system.

Successful exploitation of the vulnerability results in information disclosure.

8) Double free (CVE-ID: N/A)

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists due to double free. A remote attacker can create a node list using the DOMXPath query() or evaluate() functions, remove the nodes from the document by writing to nodeValue of an ancestor, trigger "double free or corruption" and execute arbitrary code with web server privileges.

Successful exploitation of the vulnerability may result in system compromise.

9) Stack-based buffer overflow (CVE-ID: CVE-2017-11628)

The vulnerability allows a remote attacker to cause DoS condition or potentially execute arbitrary code.

The weakness exists due to stack buffer overflow in PHP INI parsing API 2 when handling malicious input. A remote attacker can send specially crafted data, trigger stack buffer overflow in zend_ini_do_op() that may lead to out-of-bounds write, cause the application to crash or execute arbitrary code with web server privileges.

Successful exploitation of the vulnerability may result in system compromise.

10) Out-of-bounds read (CVE-ID: CVE-2017-7890)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to out-of-bounds read in GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.cwddx_deserialize(). A remote attacker can use a specially crafted GIF image with the smallest global color table of size 2 and read arbitrary files one system.

Successful exploitation of the vulnerability results in information disclosure.

11) Heap out-of-bounds read (CVE-ID: CVE-2017-11145)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exist due to heap out-of-bounds read in timelib_meridian() while deserializing an invalid dateTime value, wddx_deserialize(). A remote attacker can read arbitrary files from the process memory.

Successful exploitation of the vulnerability results in information disclosure.

12) Stack-based buffer overflow (CVE-ID: CVE-2017-11362)

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists due to stack buffer overflow in line 142 when parsing locale in msgfmt_parse_message(). A remote attacker can trigger an error when passing overtly long slocale into libicu's umsg_open() that may lead to out-of-bounds write and execute arbitrary code with web server privileges.

Successful exploitation of the vulnerability may result in system compromise.

13) Out-of-bounds read (CVE-ID: CVE-2017-12933)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists in Core PHP due to heap out-of bounds-read in finish_nested_data (). A remote attacker can read arbitrary files on the system.

Successful exploitation of the vulnerability results in information disclosure.

14) Heap use-after-free (CVE-ID: CVE-2017-12934)

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists in Core PHP due to heap use-after-free error in unserealize within zval_get_type (). A remote attacker can trigger memory corruption and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Remediation

Install update from vendor's website.

SB2017070604 - Multiple vulnerabilities in PHP

Breakdown by Severity

Description

Remediation

References