SB2018050311 - Red Hat update for php
Published: May 3, 2018 Updated: May 23, 2018
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 37 secuirty vulnerabilities.
1) Arbitrary code execution (CVE-ID: CVE-2016-7412)
The vulnerability allows a remote or local user to cause arbitrary code execution on the target system.The weakness is caused by heap overflow during handling of BIT fields in mysqlnd that allows a malicious user to execute arbitrary code.
Successful explotation of the vulnerability may result in arbitrary code execution on the vulnerable system.
2) Arbitrary code execution (CVE-ID: CVE-2016-7413)
The vulnerability allows a remote or local user to cause arbitrary code execution on the target system.The weakness is caused by use-after-free memory error in wddx_deserialize() that allows a malicious user to execute arbitrary code.
Successful explotation of the vulnerability may result in arbitrary code execution on the vulnerable system.
3) Arbitrary code execution (CVE-ID: CVE-2016-7414)
The vulnerability allows a remote or local user to cause arbitrary code execution on the target system.The weakness is caused by out-of-bounds memory error in phar_parse_zipfile() that allows a malicious user to execute arbitrary code.
Successful explotation of the vulnerability may result in arbitrary code execution on the vulnerable system.
4) Arbitrary code execution (CVE-ID: CVE-2016-7416)
The vulnerability allows a remote or local user to cause arbitrary code execution on the target system.The weakness is caused by memory corruption in local data handling that allows a malicious user to get access to the system and cause arbitrary code execution.
Successful explotation of the vulnerability may result in arbitrary code execution on the vulnerable system.
5) Arbitrary code execution (CVE-ID: CVE-2016-7417)
The vulnerability allows a remote or local user to cause arbitrary code execution on the target system.The weakness is caused by unserializing SplArray that leads to memory corruption error and allows a malicious user to execute arbitrary code.
Successful explotation of the vulnerability may result in arbitrary code execution on the vulnerable system.
6) Arbitrary code execution (CVE-ID: CVE-2016-7418)
The vulnerability allows a remote or local user to cause arbitrary code execution on the target system.The weakness is caused by out-of-bounds memory read error in php_wddx_push_element() that allows a malicious user to execute arbitrary code.
Successful explotation of the vulnerability may result in arbitrary code execution on the vulnerable system.
7) Use-after-free error (CVE-ID: CVE-2016-7479)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to resizing the 'properties' hash table of a serialized object during the unserialization process. A remote attacker can trigger use-after-free error and execute arbitrary code.
Successful exploitation of the vulnerability may result in system compromise.
8) Resource exhaustion (CVE-ID: CVE-2016-9933)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists in the gdImageFillToBorder function in gd.c due to stack consumption. A remote attacker can submit a specially crafted imagefilltoborder call that triggers use of a negative color value and cause the service to crash.
9) NULL pointer dereference (CVE-ID: CVE-2016-9934)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists in ext/wddx/wddx.c due to NULL pointer dereference. A remote attacker can submit crafted serialized data in a wddxPacket XML document, as demonstrated by a PDORow string, and cause the service to crash.
10) Out-of-bounds read (CVE-ID: CVE-2016-9935)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists in the php_wddx_push_element function in ext/wddx/wddx.c due to out-of-bounds read. A remote attacker can submit an empty boolean element in a wddxPacket XML document and cause the service to crash.
11) Use-after-free error (CVE-ID: CVE-2016-9936)
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists in the unserialize implementation in ext/standard/var.c due to use-after-free error. A remote attacker can submit crafted serialized data and cause the service to crash.
12) Incorrect calculation (CVE-ID: CVE-2016-10158)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists in the exif_convert_any_to_int function in ext/exif/exif.c due to numeric errors. A remote attacker can submit specially crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1 and cause the service to crash.
13) Integer overflow (CVE-ID: CVE-2016-10159)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists in the phar_parse_pharfile function in ext/phar/phar.c due to integer overflow. A remote attacker can submit a truncated manifest entry in a PHAR archive and cause the service to crash.
14) Off-by-one error (CVE-ID: CVE-2016-10160)
The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.The weakness exists in the phar_parse_pharfile function in ext/phar/phar.c due to off-by-one error. A remote attacker can submit a specially crafted PHAR archive with an alias mismatch and cause the service to crash or execute arbitrary code.
Successful exploitation of the vulnerability may result in system compromise.
15) Buffer over-read (CVE-ID: CVE-2016-10161)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists in the object_common1 function in ext/standard/var_unserializer.c due to buffer over-read. A remote attacker can submit specially crafted serialized data that is mishandled in a finish_nested_data call and cause the service to crash.
16) NULL pointer dereference (CVE-ID: CVE-2016-10162)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists in the php_wddx_pop_element function in ext/wddx/wddx.c due to NULL pointer dereference. A remote attacker can submit an inapplicable class name in a wddxPacket XML document, leading to mishandling in a wddx_deserialize call, and cause the service to crash.
17) Improper input validation (CVE-ID: CVE-2016-10167)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.The vulnerability exists due to improper input validation when processing images in gdImageCreateFromGd2Ctx() function in gd_gd2.c. A remote attacker can supply a malformed image and crash the application, using the affected library.
18) Integer overflow (CVE-ID: CVE-2016-10168)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack and potentially compromise vulnerable system.The vulnerability exists due to integer overflow when processing the number of horizontal and vertical chunks in an image in gd_io.c. A remote attacker create a specially crafted image file, trigger memory corruption and crash the affected application or execute arbitrary code on the target system.
19) Integer overflow (CVE-ID: CVE-2017-5340)
The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.The weakness exists in zend/zend_hash.c due to mishandling certain cases that require large array allocations. A remote attacker can submit specially crafted serialized data and cause the service to crash or execute arbitrary code.
Successful exploitation of the vulnerability may result in system compromise.
20) Information disclosure (CVE-ID: CVE-2017-7890)
The vulnerability allows a remote attacker to obtain potentially sensitive information.
The weakness exists in the GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c due to it does not zero colorMap arrays before use. A remote attacker can trick the victim into opening a specially crafted GIF image that could use the uninitialized tables to read ~700 bytes from the top of the stack and gain access to potentially sensitive information.
21) Out-of-bounds read (CVE-ID: CVE-2017-9224)
The vulnerability allows a remote attacker to obtain potentially sensitive information.The weakness exists in the mbstring due to stack out-of-bounds read in match_at() during regular expression searching. A remote attacker can trigger a logical error involving order of validation and access in match_at() and read arbitrary files on the system.
Successful exploitation of the vulnerability results in information disclosure.
22) Heap-out-of-bounds write (CVE-ID: CVE-2017-9226)
The vulnerability allows a remote attacker to execute arbitrary code.The weakness exists in the mbstring due to heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. A remote attacker can supply a malformed regular expression containing an octal number in the form of '\700', trigger
out-of-bounds write memory corruption and execute arbitrary code with web server privileges.
Successful exploitation of the vulnerability may result in system compromise.
23) Out-of-bounds read (CVE-ID: CVE-2017-9227)
The vulnerability allows a remote attacker to obtain potentially sensitive information.The weakness exists in the mbstring due to an error in handling of reg->dmin in forward_search_range(). A remote attacker can trigger stack out-of-bounds read in mbc_enc_len() during regular expression searching and read arbitrary files on the system.
Successful exploitation of the vulnerability results in information disclosure.
24) Heap-out-of-bounds write (CVE-ID: CVE-2017-9228)
The vulnerability allows a remote attacker to execute arbitrary code.The weakness exists in the mbstring due to heap out-of-bounds write in bitset_set_range() during regular expression compilation due to incorrect state transition in parse_char_class(). A remote attacker can trigger out-of-bounds write memory corruption and execute arbitrary code with web server privileges.
Successful exploitation of the vulnerability may result in system compromise.
25) Null pointer dereference (CVE-ID: CVE-2017-9229)
The vulnerability allows a remote attacker to cause DoS condition.The weakness exists in the mbstring due to an error in handling of reg->dmin in forward_search_range(). A remote attacker can trigger SIGSEGV in left_adjust_char_head() during regular expression compilation, cause NULL pointer dereference and the application to crash.
Successful exploitation of the vulnerability results in denial of service.
26) Deserialization of untrusted data (CVE-ID: CVE-2017-11143)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists in parser.c function due to deserialization of untrusted data. A remote attacker can inject specially crafted XML file and crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.
Successful exploitation of the vulnerability results in denial of service.
27) Denial of service (CVE-ID: CVE-2017-11144)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists due to the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function. A remote attacker can trigger a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission.
Successful exploitation of the vulnerability results in denial of service.
28) Out-of-bounds read (CVE-ID: CVE-2017-11145)
The vulnerability allows a remote attacker to obtain potentially sensitive information.The weakness exists due to out-of-bounds read in timelib_meridian(). A remote attacker can read arbitrary data on the target system.
29) Buffer over-read (CVE-ID: CVE-2017-11147)
The vulnerability allows a remote attacker to cause DoS condition or obtain potentially sensitive information on the target system.The weakness exists due to a flaw in the PHAR archive handler. A remote attacker can supply malicious archive files, trigger buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c and cause the PHP interpreter to crash or potentially disclose information.
30) Stack-based buffer overflow (CVE-ID: CVE-2017-11362)
The vulnerability allows a remote attacker to execute arbitrary code.The weakness exists due to stack buffer overflow in line 142 when parsing locale in msgfmt_parse_message(). A remote attacker can trigger an error when passing overtly long slocale into libicu's umsg_open() that may lead to out-of-bounds write and execute arbitrary code with web server privileges.
Successful exploitation of the vulnerability may result in system compromise.
31) Stack-based buffer overflow (CVE-ID: CVE-2017-11628)
The vulnerability allows a remote attacker to cause DoS condition or potentially execute arbitrary code.The weakness exists due to stack buffer overflow in PHP INI parsing API 2 when handling malicious input. A remote attacker can send specially crafted data, trigger stack buffer overflow in zend_ini_do_op() that may lead to out-of-bounds write, cause the application to crash or execute arbitrary code with web server privileges.
Successful exploitation of the vulnerability may result in system compromise.
32) Heap use-after-free error (CVE-ID: CVE-2017-12932)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The weakness exists due to improper use of the hash API for key deletion in a situation with an invalid array size. A remote attacker can use untrusted data to trigger heap use-after-free error in ext/standard/var_unserializer.re and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
33) Deserialization of untrusted data (CVE-ID: CVE-2017-12933)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a buffer over-read while unserializing untrusted data in the finish_nested_data function in ext/standard/var_unserializer.re. A remote attacker can perform a denial of service attack.
34) Deserialization of untrusted data (CVE-ID: CVE-2017-12934)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a heap use after free while unserializing untrusted data, related to the zval_get_type function in Zend/zend_types.h in ext/standard/var_unserializer.re. A remote attacker can trigger a use-after-free condition and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
35) Out-of-bounds read (CVE-ID: CVE-2017-16642)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists due to out-of-bounds read in timelib_meridian(). A remote attacker can cause the application to crash.
36) Infinite loop (CVE-ID: CVE-2018-5711)
The disclosed vulnerability allows a local unauthenticated attacker to cause DoS condition.
The vulnerability exists in PHP GD Graphics Library due to insufficient sanitization of user-supplied data. A local attacker can submit a specially crafted GIF, trigger an infinite loop and cause the service to crash.
37) Reflected cross-site scripting (CVE-ID: CVE-2018-5712)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists on the PHAR 404 error page due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Remediation
Install update from vendor's website.