[gentoo-announce] [ GLSA 201702-29 ] PHP: Multiple vulnerabilities - gentoo-announce

From:	Thomas Deutschmann <whissi@g.o>
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 201702-29 ] PHP: Multiple vulnerabilities
Date:	Tue, 21 Feb 2017 00:45:36
Message-Id:	`9dacac7c-4fee-a72c-5891-89185b308333@gentoo.org`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 201702-29

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: Normal

8

    Title: PHP: Multiple vulnerabilities

9

     Date: February 21, 2017

10

     Bugs: #604776, #606626

11

       ID: 201702-29

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been found in PHP, the worst of which

19

could lead to arbitrary code execution or cause a Denial of Service

20

condition.

21

22

Background

23

==========

24

25

PHP is a widely-used general-purpose scripting language that is

26

especially suited for Web development and can be embedded into HTML.

27

28

Affected packages

29

=================

30

31

    -------------------------------------------------------------------

32

     Package              /     Vulnerable     /            Unaffected

33

    -------------------------------------------------------------------

34

  1  dev-lang/php                 < 5.6.30                  >= 5.6.30

35

36

Description

37

===========

38

39

Multiple vulnerabilities have been discovered in PHP. Please review the

40

CVE identifiers referenced below for details.

41

42

Impact

43

======

44

45

An attacker could possibly execute arbitrary code or create a Denial of

46

Service condition.

47

48

Workaround

49

==========

50

51

There is no known workaround at this time.

52

53

Resolution

54

==========

55

56

All PHP 5.6 users should upgrade to the latest version:

57

58

  # emerge --sync

59

  # emerge --ask --oneshot --verbose ">=dev-lang/php-5.6.30:5.6"

60

61

References

62

==========

63

64

[ 1 ] CVE-2016-10158

65

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10158

66

[ 2 ] CVE-2016-10159

67

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10159

68

[ 3 ] CVE-2016-10160

69

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10160

70

[ 4 ] CVE-2016-10161

71

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10161

72

[ 5 ] CVE-2016-9935

73

      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9935

74

75

Availability

76

============

77

78

This GLSA and any updates to it are available for viewing at

79

the Gentoo Security Website:

80

81

 https://security.gentoo.org/glsa/201702-29

82

83

Concerns?

84

=========

85

86

Security is a primary focus of Gentoo Linux and ensuring the

87

confidentiality and security of our users' machines is of utmost

88

importance to us. Any security concerns should be addressed to

89

security@g.o or alternatively, you may file a bug at

90

https://bugs.gentoo.org.

91

92

License

93

=======

94

95

Copyright 2017 Gentoo Foundation, Inc; referenced text

96

belongs to its owner(s).

97

98

The contents of this document are licensed under the

99

Creative Commons - Attribution / Share Alike license.

100

101

http://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 201702-29
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Normal
8	Title: PHP: Multiple vulnerabilities
9	Date: February 21, 2017
10	Bugs: #604776, #606626
11	ID: 201702-29
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been found in PHP, the worst of which
19	could lead to arbitrary code execution or cause a Denial of Service
20	condition.
21
22	Background
23	==========
24
25	PHP is a widely-used general-purpose scripting language that is
26	especially suited for Web development and can be embedded into HTML.
27
28	Affected packages
29	=================
30
31	-------------------------------------------------------------------
32	Package / Vulnerable / Unaffected
33	-------------------------------------------------------------------
34	1 dev-lang/php < 5.6.30 >= 5.6.30
35
36	Description
37	===========
38
39	Multiple vulnerabilities have been discovered in PHP. Please review the
40	CVE identifiers referenced below for details.
41
42	Impact
43	======
44
45	An attacker could possibly execute arbitrary code or create a Denial of
46	Service condition.
47
48	Workaround
49	==========
50
51	There is no known workaround at this time.
52
53	Resolution
54	==========
55
56	All PHP 5.6 users should upgrade to the latest version:
57
58	# emerge --sync
59	# emerge --ask --oneshot --verbose ">=dev-lang/php-5.6.30:5.6"
60
61	References
62	==========
63
64	[ 1 ] CVE-2016-10158
65	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10158
66	[ 2 ] CVE-2016-10159
67	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10159
68	[ 3 ] CVE-2016-10160
69	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10160
70	[ 4 ] CVE-2016-10161
71	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-10161
72	[ 5 ] CVE-2016-9935
73	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9935
74
75	Availability
76	============
77
78	This GLSA and any updates to it are available for viewing at
79	the Gentoo Security Website:
80
81	https://security.gentoo.org/glsa/201702-29
82
83	Concerns?
84	=========
85
86	Security is a primary focus of Gentoo Linux and ensuring the
87	confidentiality and security of our users' machines is of utmost
88	importance to us. Any security concerns should be addressed to
89	security@g.o or alternatively, you may file a bug at
90	https://bugs.gentoo.org.
91
92	License
93	=======
94
95	Copyright 2017 Gentoo Foundation, Inc; referenced text
96	belongs to its owner(s).
97
98	The contents of this document are licensed under the
99	Creative Commons - Attribution / Share Alike license.
100
101	http://creativecommons.org/licenses/by-sa/2.5