Detections
Analytics

Fedora 28 : php (2018-9438795217)

high Nessus Plugin ID 120629

Language:

Synopsis

The remote Fedora host is missing a security update.

Description

**PHP version 7.2.8** (19 Jul 2018)

**Core:**

 - Fixed bug php#76534 (PHP hangs on 'illegal string offset on string references with an error handler). (Laruence)

 - Fixed bug php#76520 (Object creation leaks memory when executed over HTTP). (Nikita)

 - Fixed bug php#76502 (Chain of mixed exceptions and errors does not serialize properly). (Nikita)

**Date:**

 - Fixed bug php#76462 (Undefined property:
 DateInterval::$f). (Anatol)

**EXIF:**

 - Fixed bug php#76409 (heap use after free in
 _php_stream_free). (cmb)

 - Fixed bug php#76423 (Int Overflow lead to Heap OverFlow in exif_thumbnail_extract of exif.c). (Stas)

 - Fixed bug php#76557 (heap-buffer-overflow (READ of size 48) while reading exif data). (Stas)

**FPM:**

 - Fixed bug php#73342 (Vulnerability in php-fpm by changing stdin to non-blocking). (Nikita)

**GMP:**

 - Fixed bug php#74670 (Integer Underflow when unserializing GMP and possible other classes). (Nikita)

**intl:**

 - Fixed bug php#76556 (get_debug_info handler for BreakIterator shows wrong type). (cmb)

**mbstring:**

 - Fixed bug php#76532 (Integer overflow and excessive memory usage in mb_strimwidth). (MarcusSchwarz)

**Opcache:**

 - Fixed bug php#76477 (Opcache causes empty return value).
 (Nikita, Laruence)

**PGSQL:**

 - Fixed bug php#76548 (pg_fetch_result did not fetch the next row). (Anatol)

**phpdbg:**

 - Fix arginfo wrt. optional/required parameters. (cmb)

**Reflection:**

 - Fixed bug php#76536 (PHP crashes with core dump when throwing exception in error handler). (Laruence)

 - Fixed bug php#75231 (ReflectionProperty#getValue() incorrectly works with inherited classes). (Nikita)

**Standard:**

 - Fixed bug php#76505 (array_merge_recursive() is duplicating sub-array keys). (Laruence)

 - Fixed bug php#71848 (getimagesize with $imageinfo returns false). (cmb)

**Win32:**

 - Fixed bug php#76459 (windows linkinfo lacks openbasedir check). (Anatol)

**ZIP:**

 - Fixed bug php#76461 (OPSYS_Z_CPM defined instead of OPSYS_CPM). (Dennis Birkholz, Remi)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected php package.

See Also

https://bodhi.fedoraproject.org/updates/FEDORA-2018-9438795217

Plugin Details

Severity: High

ID: 120629

File Name: fedora_2018-9438795217.nasl

Version: 1.4

Type: local

Agent: unix

Published: 1/3/2019

Updated: 1/6/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Vulnerability Information

CPE: cpe:/o:fedoraproject:fedora:28, p-cpe:/a:fedoraproject:fedora:php

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Patch Publication Date: 7/27/2018

Vulnerability Publication Date: 7/27/2018

Reference Information