SUSE-SU-2017:1717-1

Dashboard / Vulnerabilities / SUSE-SU-2017:1717-1

SUSE-SU-2017:1717-1

Summary: Security update for php7

Details: This update for php7 fixes the following security issues: - CVE-2017-9224: stack out-of-bounds read occurs in match_at() could lead to Denial of service (bsc#1040891) - CVE-2017-9226: heap out-of-bounds write orread occurs in next_state_val() could lead to Denial of service(bsc#1040889) - CVE-2017-9227: stack out-of-bounds read in mbc_enc_len() could lead to Denial of service (bsc#1040883) - CVE-2017-6441: The _zval_get_long_func_ex in Zend/zend_operators.c in PHP allowed attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted use of 'declare(ticks=' in a PHP script (bsc#1032155). - CVE-2016-6294: The locale_accept_from_http function in ext/intl/locale/locale_methods.c did not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allowed remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument (bsc#1035111).

References: https://www.suse.com/support/update/announcement/2017/suse-su-20171717-1/, https://bugzilla.suse.com/1032155, https://bugzilla.suse.com/1035111, https://bugzilla.suse.com/1040883, https://bugzilla.suse.com/1040889, https://bugzilla.suse.com/1040891, https://www.suse.com/security/cve/CVE-2016-6294, https://www.suse.com/security/cve/CVE-2017-6441, https://www.suse.com/security/cve/CVE-2017-9224, https://www.suse.com/security/cve/CVE-2017-9226, https://www.suse.com/security/cve/CVE-2017-9227