SUSE-SU-2015:1253-1

    Dashboard / Vulnerabilities / SUSE-SU-2015:1253-1

    SUSE-SU-2015:1253-1

    Published: 23 Jun 2015Last Modified: 4 Feb 2026

    Summary: Security update for php5

    Details: This security update of PHP fixes the following issues: Security issues fixed: * CVE-2015-4024 [bnc#931421]: Fixed multipart/form-data remote DOS Vulnerability. * CVE-2015-4026 [bnc#931776]: pcntl_exec() did not check path validity. * CVE-2015-4022 [bnc#931772]: Fixed and overflow in ftp_genlist() that resulted in a heap overflow. * CVE-2015-4021 [bnc#931769]: Fixed memory corruption in phar_parse_tarfile when entry filename starts with NULL. * CVE-2015-4148 [bnc#933227]: Fixed SoapClient's do_soap_call() type confusion after unserialize() information disclosure. * CVE-2015-4602 [bnc#935224]: Fixed an incomplete Class unserialization type confusion. * CVE-2015-4599, CVE-2015-4600, CVE-2015-4601 [bnc#935226]: Fixed type confusion issues in unserialize() with various SOAP methods. * CVE-2015-4603 [bnc#935234]: Fixed exception::getTraceAsString type confusion issue after unserialize. * CVE-2015-4644 [bnc#935274]: Fixed a crash in php_pgsql_meta_data. * CVE-2015-4643 [bnc#935275]: Fixed an integer overflow in ftp_genlist() that could result in a heap overflow. * CVE-2015-3411, CVE-2015-3412, CVE-2015-4598 [bnc#935227], [bnc#935232]: Added missing null byte checks for paths in various PHP extensions. Bugs fixed: * configure php-fpm with --localstatedir=/var [bnc#927147] * fix timezone map [bnc#919080]

    References: https://www.suse.com/support/update/announcement/2015/suse-su-20151253-1/, https://bugzilla.suse.com/919080, https://bugzilla.suse.com/927147, https://bugzilla.suse.com/931421, https://bugzilla.suse.com/931769, https://bugzilla.suse.com/931772, https://bugzilla.suse.com/931776, https://bugzilla.suse.com/933227, https://bugzilla.suse.com/935224, https://bugzilla.suse.com/935226, https://bugzilla.suse.com/935227, https://bugzilla.suse.com/935232, https://bugzilla.suse.com/935234, https://bugzilla.suse.com/935274, https://bugzilla.suse.com/935275, https://www.suse.com/security/cve/CVE-2015-3411, https://www.suse.com/security/cve/CVE-2015-3412, https://www.suse.com/security/cve/CVE-2015-4021, https://www.suse.com/security/cve/CVE-2015-4022, https://www.suse.com/security/cve/CVE-2015-4024, https://www.suse.com/security/cve/CVE-2015-4026, https://www.suse.com/security/cve/CVE-2015-4148, https://www.suse.com/security/cve/CVE-2015-4598, https://www.suse.com/security/cve/CVE-2015-4599, https://www.suse.com/security/cve/CVE-2015-4600, https://www.suse.com/security/cve/CVE-2015-4601, https://www.suse.com/security/cve/CVE-2015-4602, https://www.suse.com/security/cve/CVE-2015-4603, https://www.suse.com/security/cve/CVE-2015-4643, https://www.suse.com/security/cve/CVE-2015-4644

    Affected packages

    Package

    Name: php5

    Purl: pkg:rpm/suse/php5&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -5.5.14-30.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    SUSE-SU-2015:1253-1 | CVE-DB