SB2017121805 - Ubuntu update for PHP

Description

This security bulletin contains information about 11 secuirty vulnerabilities.

1) Security restrictions bypass (CVE-ID: CVE-2016-10397)

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to incorrect handling of various URI components in the URL parse. A remote attacker can supply specially crafted URI components and bypass hostname-specific URL checks.

2) Deserialization of untrusted data (CVE-ID: CVE-2017-11143)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in parser.c function due to deserialization of untrusted data. A remote attacker can inject specially crafted XML file and crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.

Successful exploitation of the vulnerability results in denial of service.

3) Denial of service (CVE-ID: CVE-2017-11144)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function. A remote attacker can trigger a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission.

Successful exploitation of the vulnerability results in denial of service.

4) Out-of-bounds read (CVE-ID: CVE-2017-11145)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists due to out-of-bounds read in timelib_meridian(). A remote attacker can read arbitrary data on the target system.

5) Buffer over-read (CVE-ID: CVE-2017-11147)

The vulnerability allows a remote attacker to cause DoS condition or obtain potentially sensitive information on the target system.

The weakness exists due to a flaw in the PHAR archive handler. A remote attacker can supply malicious archive files, trigger buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c and cause the PHP interpreter to crash or potentially disclose information.

6) Stack-based buffer overflow (CVE-ID: CVE-2017-11628)

The vulnerability allows a remote attacker to cause DoS condition or potentially execute arbitrary code.

The weakness exists due to stack buffer overflow in PHP INI parsing API 2 when handling malicious input. A remote attacker can send specially crafted data, trigger stack buffer overflow in zend_ini_do_op() that may lead to out-of-bounds write, cause the application to crash or execute arbitrary code with web server privileges.

Successful exploitation of the vulnerability may result in system compromise.

7) Out-of-bounds read (CVE-ID: CVE-2017-9224)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists in the mbstring due to stack out-of-bounds read in match_at() during regular expression searching. A remote attacker can trigger a logical error involving order of validation and access in match_at() and read arbitrary files on the system.

Successful exploitation of the vulnerability results in information disclosure.

8) Heap-out-of-bounds write (CVE-ID: CVE-2017-9226)

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists in the mbstring due to heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. A remote attacker can supply a malformed regular expression containing an octal number in the form of '\700', trigger
out-of-bounds write memory corruption and execute arbitrary code with web server privileges.

Successful exploitation of the vulnerability may result in system compromise.

9) Out-of-bounds read (CVE-ID: CVE-2017-9227)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists in the mbstring due to an error in handling of reg->dmin in forward_search_range(). A remote attacker can trigger stack out-of-bounds read in mbc_enc_len() during regular expression searching and read arbitrary files on the system.

Successful exploitation of the vulnerability results in information disclosure.

10) Heap-out-of-bounds write (CVE-ID: CVE-2017-9228)

The vulnerability allows a remote attacker to execute arbitrary code.

The weakness exists in the mbstring due to heap out-of-bounds write in bitset_set_range() during regular expression compilation due to incorrect state transition in parse_char_class(). A remote attacker can trigger out-of-bounds write memory corruption and execute arbitrary code with web server privileges.

Successful exploitation of the vulnerability may result in system compromise.

11) Null pointer dereference (CVE-ID: CVE-2017-9229)

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists in the mbstring due to an error in handling of reg->dmin in forward_search_range(). A remote attacker can trigger SIGSEGV in left_adjust_char_head() during regular expression compilation, cause NULL pointer dereference and the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Remediation

Install update from vendor's website.

References

• http://www.ubuntu.com/usn/usn-3382-2/