11:52 p.m.
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2016-db71b72137
2016-09-27 21:44:48.198874
--------------------------------------------------------------------------------
Name : php
Product : Fedora 23
Version : 5.6.26
Release : 1.fc23
URL : http://www.php.net/
Summary : PHP scripting language for creating dynamic web sites
Description :
PHP is an HTML-embedded scripting language. PHP attempts to make it
easy for developers to write dynamically generated web pages. PHP also
offers built-in database integration for several commercial and
non-commercial database management systems, so writing a
database-enabled webpage with PHP is fairly simple. The most common
use of PHP coding is probably as a replacement for CGI scripts.
The php package contains the module (often referred to as mod_php)
which adds support for the PHP language to Apache HTTP Server.
--------------------------------------------------------------------------------
Update Information:
15 Sep 2016 **PHP version 5.6.26** **Core:** * Fixed bug php#72907 (null
pointer deref, segfault in gc_remove_zval_from_buffer (zend_gc.c:260)).
(Laruence) **Dba:** * Fixed bug php#71514 (Bad dba_replace condition because
of wrong API usage). (cmb) * Fixed bug php#70825 (Cannot fetch multiple values
with group in ini file). (cmb) **EXIF:** * Fixed bug php#72926 (Uninitialized
Thumbail Data Leads To Memory Leakage in exif_process_IFD_in_TIFF). (Stas)
**FTP:** * Fixed bug php#70195 (Cannot upload file using ftp_put to FTPES with
require_ssl_reuse). (Benedict Singer) **GD:** * Fixed bug php#66005 (imagecopy
does not support 1bit transparency on truecolor images). (cmb) * Fixed bug
php#72913 (imagecopy() loses single-color transparency on palette images). (cmb)
* Fixed bug php#68716 (possible resource leaks in _php_image_convert()). (cmb)
**Intl:** * Fixed bug php#73007 (add locale length check). (Stas) **JSON:** *
Fixed bug php#72787 (json_decode reads out of bounds). (Jakub Zelenka)
**mbstring:** * Fixed bug php#66797 (mb_substr only takes 32-bit signed
integer). (cmb) * Fixed bug php#72910 (Out of bounds heap read in mbc_to_code()
/ triggered by mb_ereg_match()). (Stas) **MSSQL:** * Fixed bug php#72039 (Use
of uninitialised value on mssql_guid_string). (Kalle) **Mysqlnd:** * Fixed bug
php#72293 (Heap overflow in mysqlnd related to BIT fields). (Stas) **Phar:** *
Fixed bug php#72928 (Out of bound when verify signature of zip phar in
phar_parse_zipfile). (Stas) * Fixed bug php#73035 (Out of bound when verify
signature of tar phar in phar_parse_tarfile). (Stas) **PDO:** * Fixed bug
php#60665 (call to empty() on NULL result using PDO::FETCH_LAZY returns false).
(cmb) **PDO_pgsql:** * Implemented FR php#72633 (Postgres PDO lastInsertId()
should work without specifying a sequence). (Pablo Santiago S��nchez, Matteo) *
Fixed bug php#72759 (Regression in pgo_pgsql). (Anatol) **SPL:** * Fixed bug
php#73029 (Missing type check when unserializing SplArray). (Stas)
**Standard:** * Fixed bug php#72823 (strtr out-of-bound access). (cmb) * Fixed
bug php#72278 (getimagesize returning FALSE on valid jpg). (cmb) * Fixed bug
php#65550 (get_browser() incorrectly parses entries with "+" sign). (cmb) *
Fixed bug php#71882 (Negative ftruncate() on php://memory exhausts memory).
(cmb) * Fixed bug php#73011 (integer overflow in fgets cause heap corruption).
(Stas) * Fixed bug php#73017 (memory corruption in wordwrap function). (Stas) *
Fixed bug php#73045 (integer overflow in fgetcsv caused heap corruption). (Stas)
* Fixed bug php#73052 (Memory Corruption in During Deserialized-object
Destruction) (Stas) **Streams:** * Fixed bug php#72853 (stream_set_blocking
doesn't work). (Laruence) **Wddx:** * Fixed bug php#72860 (wddx_deserialize
use-after-free). (Stas) * Fixed bug php#73065 (Out-Of-Bounds Read in
php_wddx_push_element). (Stas) **XML:** * Fixed bug php#72085 (SEGV on unknown
address zif_xml_parse). (cmb) * Fixed bug php#72927 (integer overflow in
xml_utf8_encode). (Stas)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1377352 - CVE-2016-7418 php: Null pointer dereference in
php_wddx_push_element
https://bugzilla.redhat.com/show_bug.cgi?id=1377352
[ 2 ] Bug #1377344 - CVE-2016-7417 php: Missing type check when unserializing SplArray
https://bugzilla.redhat.com/show_bug.cgi?id=1377344
[ 3 ] Bug #1377340 - CVE-2016-7416 php: Stack based buffer overflow in
msgfmt_format_message
https://bugzilla.redhat.com/show_bug.cgi?id=1377340
[ 4 ] Bug #1377336 - CVE-2016-7414 php: Out of bounds heap read when verifying signature
of zip phar in phar_parse_zipfile
https://bugzilla.redhat.com/show_bug.cgi?id=1377336
[ 5 ] Bug #1377314 - CVE-2016-7413 php: Use after free in wddx_deserialize
https://bugzilla.redhat.com/show_bug.cgi?id=1377314
[ 6 ] Bug #1377311 - CVE-2016-7412 php: Heap overflow in mysqlnd when not receiving
UNSIGNED_FLAG in BIT field
https://bugzilla.redhat.com/show_bug.cgi?id=1377311
[ 7 ] Bug #1377303 - CVE-2016-7411 php: Memory corruption when destructing deserialized
object
https://bugzilla.redhat.com/show_bug.cgi?id=1377303
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update php' at the command line.
For more information, refer to "Managing Software with yum",
available at https://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------