Debian DLA-1397-1 : php5 security update
High Nessus Plugin ID 110697
SynopsisThe remote Debian host is missing a security update.
DescriptionSeveral vulnerabilities were found in PHP, a widely-used open source general purpose scripting language :
A stack-buffer-overflow while parsing HTTP response results in copying a large string and possible memory corruption and/or denial of service
Dumpable FPM child processes allow bypassing opcache access controls resulting in potential information disclosure where one user can obtain information about another user's running PHP applications
An invalid sequence of bytes can trigger an infinite loop in the stream filter convert.iconv
A previous fix for CVE-2018-5712 may not be complete, resulting in an additional vulnerability in the form of a reflected XSS in the PHAR 403 and 404 error pages
A malicious remote LDAP server can send a crafted response that will cause a denial of service (NULL pointer dereference resulting in an application crash)
A crafted JPEG file can case an out-of-bounds read and heap buffer overflow
For Debian 8 'Jessie', these problems have been fixed in version 5.6.36+dfsg-0+deb8u1.
We recommend that you upgrade your php5 packages.
NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
SolutionUpgrade the affected packages.