New! Vulnerability Priority Rating (VPR)
Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.
VPR Score: 3.6
SynopsisThe remote Fedora host is missing one or more security updates.
Description29 May 2014, PHP 5.5.13
CLI server :
- Fixed bug #67079 (Missing MIME types for XML/XSL files).
- Fixed bug #66431 (Special Character via COM Interface (CP_UTF8)). (Anatol)
- Fixed bug #65701 (copy() doesn't work when destination filename is created by tempnam()). (Boro Sitnikovski)
- Fixed bug #67072 (Echoing unserialized 'SplFileObject' crash). (Anatol)
- Fixed bug #67245 (usage of memcpy() with overlapping src and dst in zend_exceptions.c). (Bob)
- Fixed bug #67247 (spl_fixedarray_resize integer overflow). (Stas)
- Fixed bug #67249 (printf out-of-bounds read). (Stas)
- Fixed bug #67250 (iptcparse out-of-bounds read).
- Fixed bug #67252 (convert_uudecode out-of-bounds read). (Stas)
- Fixed bug #64247 (CURLOPT_INFILE doesn't allow reset).
- Fixed bug #67118 (DateTime constructor crash with invalid data). (Anatol)
- Fixed bug #67251 (date_parse_from_format out-of-bounds read). (Stas)
- Fixed bug #67253 (timelib_meridian_with_check out-of-bounds read). (Stas)
- Fixed bug #67081 (DOMDocumentType->internalSubset returns entire DOCTYPE tag, not only the subset).
- Fixed bug #66307 (Fileinfo crashes with powerpoint files). (Anatol)
- Fixed bug #67327 (fileinfo: CDF infinite loop in nelements DoS) (CVE-2014-0238).
- Fixed bug #67328 (fileinfo: fileinfo: numerous file_printf calls resulting in performance degradation) (CVE-2014-0237).
- Fixed bug #66908 (php-fpm reload leaks epoll_create() file descriptor). (Julio Pintos)
- Fixed bug #67248 (imageaffinematrixget missing check of parameters). (Stas)
- Fixed bug #67238 (Ungreedy and min/max quantifier bug, applied patch from the upstream). (Anatol)
- Fix bug #64498 ($phar->buildFromDirectory can't compress file with an accent in its name). (PR #588)
Backported from 5.5.14 :
- Fileinfo: Fixed bug #67326 (fileinfo:
cdf_read_short_sector insufficient boundary check).
- Core: workaround regression introduce in fix for #67072
- Date: Fixed regression in fix for bug #67118 (constructor can't be called twice).
Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
SolutionUpdate the affected php, php-doctrine-orm and / or php-phpunit-PHPUnit-MockObject packages.