USN-2391-1

Dashboard / Vulnerabilities / USN-2391-1

USN-2391-1

Summary: php5 vulnerabilities

Details: Symeon Paraschoudis discovered that PHP incorrectly handled the mkgmtime function. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2014-3668) Symeon Paraschoudis discovered that PHP incorrectly handled unserializing objects. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2014-3669) Otto Ebeling discovered that PHP incorrectly handled the exif_thumbnail function. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-3670) Francisco Alonso that PHP incorrectly handled ELF files in the fileinfo extension. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2014-3710) It was discovered that PHP incorrectly handled NULL bytes when processing certain URLs with the curl functions. A remote attacker could possibly use this issue to bypass filename restrictions and obtain access to sensitive files. (No CVE number)

References: https://ubuntu.com/security/notices/USN-2391-1, https://ubuntu.com/security/CVE-2014-3668, https://ubuntu.com/security/CVE-2014-3669, https://ubuntu.com/security/CVE-2014-3670, https://ubuntu.com/security/CVE-2014-3710