SUSE-SU-2017:2317-1

    Dashboard / Vulnerabilities / SUSE-SU-2017:2317-1

    SUSE-SU-2017:2317-1

    Published: 31 Aug 2017Last Modified: 2 May 2025

    Summary: Security update for php5

    Details: This update for php5 fixes the following issues: - CVE-2016-10397: parse_url() can be bypassed to return fake host. (bsc#1047454) - CVE-2017-11143: An invalid free in the WDDX deserialization of booleanparameters could be used by attackers able to inject XML for deserialization tocrash the PHP interpreter. (bsc#1048097) - CVE-2017-11144: The opensslextension PEM sealing code did not check the return value of the OpenSSL sealingfunction, which could lead to a crash. (bsc#1048096) - CVE-2017-11145: Lack of bounds checks in timelib_meridian coud lead to information leak. (bsc#1048112) - CVE-2017-11146: Lack of bounds checks in timelib_meridian parse code could lead to information leak. (bsc#1048111) - CVE-2017-11147: The PHAR archive handler could beused by attackers supplying malicious archive files to crash the PHP interpreteror potentially disclose information. (bsc#1048094) - CVE-2016-5766: Integer Overflow in _gd2GetHeader() resulting could lead to heap overflow (bsc#986386) - CVE-2017-11628: Stack-base dbuffer overflow in zend_ini_do_op() in Zend/zend_ini_parser.c (bsc#1050726) - CVE-2017-7890: Buffer over-read from unitialized data in gdImageCreateFromGifCtx function could lead to denial of service (bsc#1050241)

    References: https://www.suse.com/support/update/announcement/2017/suse-su-20172317-1/, https://bugzilla.suse.com/1047454, https://bugzilla.suse.com/1048094, https://bugzilla.suse.com/1048096, https://bugzilla.suse.com/1048097, https://bugzilla.suse.com/1048111, https://bugzilla.suse.com/1048112, https://bugzilla.suse.com/1050241, https://bugzilla.suse.com/1050726, https://bugzilla.suse.com/986386, https://www.suse.com/security/cve/CVE-2016-10397, https://www.suse.com/security/cve/CVE-2016-5766, https://www.suse.com/security/cve/CVE-2017-11143, https://www.suse.com/security/cve/CVE-2017-11144, https://www.suse.com/security/cve/CVE-2017-11145, https://www.suse.com/security/cve/CVE-2017-11146, https://www.suse.com/security/cve/CVE-2017-11147, https://www.suse.com/security/cve/CVE-2017-11628, https://www.suse.com/security/cve/CVE-2017-7890

    Affected packages

    Package

    Name: php5

    Purl: pkg:rpm/suse/php5&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -5.5.14-109.5.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    SUSE-SU-2017:2317-1 | CVE-DB