Detections
Analytics

Fedora 20 : php-5.5.23-1.fc20 (2015-4216)

high Nessus Plugin ID 82545

Language:

Synopsis

The remote Fedora host is missing a security update.

Description

**19 Mar 2015, PHP 5.5.23**

Core :

 - Fixed bug #69174 (leaks when unused inner class use traits precedence). (Laruence)

 - Fixed bug #69139 (Crash in gc_zval_possible_root on unserialize). (Laruence)

 - Fixed bug #69121 (Segfault in get_current_user when script owner is not in passwd with ZTS build). (dan at syneto dot net)

 - Fixed bug #65593 (Segfault when calling ob_start from output buffering callback). (Mike)

 - Fixed bug #69017 (Fail to push to the empty array with the constant value defined in class scope). (Laruence)

 - Fixed bug #68986 (pointer returned by php_stream_fopen_temporary_file not validated in memory.c). (nayana at ddproperty dot com)

 - Fixed bug #68166 (Exception with invalid character causes segv). (Rasmus)

 - Fixed bug #69141 (Missing arguments in reflection info for some builtin functions). (kostyantyn dot lysyy at oracle dot com)

 - Fixed bug #68976 (Use After Free Vulnerability in unserialize()). (Stas)

 - Fixed bug #69134 (Per Directory Values overrides PHP_INI_SYSTEM configuration options). (Anatol Belski)

 - Fixed bug #69207 (move_uploaded_file allows nulls in path). (Stas)

CGI :

 - Fixed bug #69015 (php-cgi's getopt does not see $argv).
 (Laruence)

CLI :

 - Fixed bug #67741 (auto_prepend_file messes up __LINE__).
 (Reeze Xia)

cURL :

 - Fixed bug #69088 (PHP_MINIT_FUNCTION does not fully initialize cURL on Win32). (Grant Pannell)

 - Add CURLPROXY_SOCKS4A and CURLPROXY_SOCKS5_HOSTNAME constants if supported by libcurl. (Linus Unneback)

Ereg :

 - Fixed bug #69248 (heap overflow vulnerability in regcomp.c). (Stas)

FPM :

 - Fixed bug #68822 (request time is reset too early).
 (honghu069 at 163 dot com)

ODBC :

 - Fixed bug #68964 (Allowed memory size exhausted with odbc_exec). (Anatol)

Opcache :

 - Fixed bug #69125 (Array numeric string as key).
 (Laruence)

 - Fixed bug #69038 (switch(SOMECONSTANT) misbehaves).
 (Laruence)

OpenSSL :

 - Fixed bugs #61285, #68329, #68046, #41631 (encrypted streams don't observe socket timeouts). (Brad Broerman)

pgsql :

 - Fixed bug #68638 (pg_update() fails to store infinite values). (william dot welter at 4linux dot com dot br, Laruence)

Readline :

 - Fixed bug #69054 (Null dereference in readline_(read|write)_history() without parameters).
 (Laruence)

SOAP :

 - Fixed bug #69085 (SoapClient's __call() type confusion through unserialize()). (andrea dot palazzo at truel dot it, Laruence)

SPL :

 - Fixed bug #69108 ('Segmentation fault' when (de)serializing SplObjectStorage). (Laruence)

 - Fixed bug #68557 (RecursiveDirectoryIterator::seek(0) broken after calling getChildren()). (Julien)

ZIP :

 - Fixed bug #69253 (ZIP Integer Overflow leads to writing past heap boundary) (CVE-2015-2331). (Stas)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected php package.

See Also

https://bugzilla.redhat.com/show_bug.cgi?id=1204868

http://www.nessus.org/u?fc6444a1

Plugin Details

Severity: High

ID: 82545

File Name: fedora_2015-4216.nasl

Version: 1.5

Type: local

Agent: unix

Published: 4/3/2015

Updated: 1/11/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Vulnerability Information

CPE: cpe:/o:fedoraproject:fedora:20, p-cpe:/a:fedoraproject:fedora:php

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Patch Publication Date: 3/21/2015

Vulnerability Publication Date: 3/21/2015

Reference Information

FEDORA: 2015-4216