USN-5006-2

Dashboard / Vulnerabilities / USN-5006-2

USN-5006-2

Summary: php5, php7.0 vulnerabilities

Details: USN-5006-1 fixed several vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: It was discovered that PHP incorrectly handled certain PHAR files. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2020-7068) It was discovered that PHP incorrectly handled parsing URLs with passwords. A remote attacker could possibly use this issue to cause PHP to mis-parse the URL and produce wrong data. (CVE-2020-7071) It was discovered that PHP incorrectly handled certain malformed XML data when being parsed by the SOAP extension. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2021-21702) It was discovered that PHP incorrectly handled the pdo_firebase module. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2021-21704) It was discovered that PHP incorrectly handled the FILTER_VALIDATE_URL check. A remote attacker could possibly use this issue to perform a server- side request forgery attack. (CVE-2021-21705)

References: https://ubuntu.com/security/notices/USN-5006-2, https://ubuntu.com/security/CVE-2020-7068, https://ubuntu.com/security/CVE-2020-7071, https://ubuntu.com/security/CVE-2021-21702, https://ubuntu.com/security/CVE-2021-21704, https://ubuntu.com/security/CVE-2021-21705