[gentoo-announce] [ GLSA 202003-57 ] PHP: Multiple vulnerabilities - gentoo-announce

From:	Thomas Deutschmann <whissi@g.o>
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 202003-57 ] PHP: Multiple vulnerabilities
Date:	Thu, 26 Mar 2020 16:07:13
Message-Id:	`5246789c-9aa9-f346-2c6e-f62483064225@gentoo.org`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 202003-57

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: High

8

    Title: PHP: Multiple vulnerabilities

9

     Date: March 26, 2020

10

     Bugs: #671872, #706168, #710304, #713484

11

       ID: 202003-57

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been found in PHP, the worst of which

19

could result in the execution of arbitrary shell commands.

20

21

Background

22

==========

23

24

PHP is an open source general-purpose scripting language that is

25

especially suited for web development.

26

27

Affected packages

28

=================

29

30

    -------------------------------------------------------------------

31

     Package              /     Vulnerable     /            Unaffected

32

    -------------------------------------------------------------------

33

  1  dev-lang/php                 < 7.4.4                  *>= 7.2.29

34

                                                           *>= 7.3.16

35

                                                            *>= 7.4.4

36

37

Description

38

===========

39

40

Multiple vulnerabilities have been discovered in PHP. Please review the

41

CVE identifiers referenced below for details.

42

43

Impact

44

======

45

46

An attacker could possibly execute arbitrary shell commands, cause a

47

Denial of Service condition or obtain sensitive information.

48

49

Workaround

50

==========

51

52

There is no known workaround at this time.

53

54

Resolution

55

==========

56

57

All PHP 7.2.x users should upgrade to the latest version:

58

59

  # emerge --sync

60

  # emerge --ask --oneshot --verbose ">=dev-lang/php-7.2.29"

61

62

All PHP 7.3.x users should upgrade to the latest version:

63

64

  # emerge --sync

65

  # emerge --ask --oneshot --verbose ">=dev-lang/php-7.3.16"

66

67

All PHP 7.4.x users should upgrade to the latest version:

68

69

  # emerge --sync

70

  # emerge --ask --oneshot --verbose ">=dev-lang/php-7.4.4"

71

72

References

73

==========

74

75

[ 1 ] CVE-2018-19518

76

      https://nvd.nist.gov/vuln/detail/CVE-2018-19518

77

[ 2 ] CVE-2020-7059

78

      https://nvd.nist.gov/vuln/detail/CVE-2020-7059

79

[ 3 ] CVE-2020-7060

80

      https://nvd.nist.gov/vuln/detail/CVE-2020-7060

81

[ 4 ] CVE-2020-7061

82

      https://nvd.nist.gov/vuln/detail/CVE-2020-7061

83

[ 5 ] CVE-2020-7062

84

      https://nvd.nist.gov/vuln/detail/CVE-2020-7062

85

[ 6 ] CVE-2020-7063

86

      https://nvd.nist.gov/vuln/detail/CVE-2020-7063

87

[ 7 ] CVE-2020-7064

88

      https://nvd.nist.gov/vuln/detail/CVE-2020-7064

89

[ 8 ] CVE-2020-7065

90

      https://nvd.nist.gov/vuln/detail/CVE-2020-7065

91

[ 9 ] CVE-2020-7066

92

      https://nvd.nist.gov/vuln/detail/CVE-2020-7066

93

94

Availability

95

============

96

97

This GLSA and any updates to it are available for viewing at

98

the Gentoo Security Website:

99

100

 https://security.gentoo.org/glsa/202003-57

101

102

Concerns?

103

=========

104

105

Security is a primary focus of Gentoo Linux and ensuring the

106

confidentiality and security of our users' machines is of utmost

107

importance to us. Any security concerns should be addressed to

108

security@g.o or alternatively, you may file a bug at

109

https://bugs.gentoo.org.

110

111

License

112

=======

113

114

Copyright 2020 Gentoo Foundation, Inc; referenced text

115

belongs to its owner(s).

116

117

The contents of this document are licensed under the

118

Creative Commons - Attribution / Share Alike license.

119

120

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 202003-57
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: High
8	Title: PHP: Multiple vulnerabilities
9	Date: March 26, 2020
10	Bugs: #671872, #706168, #710304, #713484
11	ID: 202003-57
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been found in PHP, the worst of which
19	could result in the execution of arbitrary shell commands.
20
21	Background
22	==========
23
24	PHP is an open source general-purpose scripting language that is
25	especially suited for web development.
26
27	Affected packages
28	=================
29
30	-------------------------------------------------------------------
31	Package / Vulnerable / Unaffected
32	-------------------------------------------------------------------
33	1 dev-lang/php < 7.4.4 *>= 7.2.29
34	*>= 7.3.16
35	*>= 7.4.4
36
37	Description
38	===========
39
40	Multiple vulnerabilities have been discovered in PHP. Please review the
41	CVE identifiers referenced below for details.
42
43	Impact
44	======
45
46	An attacker could possibly execute arbitrary shell commands, cause a
47	Denial of Service condition or obtain sensitive information.
48
49	Workaround
50	==========
51
52	There is no known workaround at this time.
53
54	Resolution
55	==========
56
57	All PHP 7.2.x users should upgrade to the latest version:
58
59	# emerge --sync
60	# emerge --ask --oneshot --verbose ">=dev-lang/php-7.2.29"
61
62	All PHP 7.3.x users should upgrade to the latest version:
63
64	# emerge --sync
65	# emerge --ask --oneshot --verbose ">=dev-lang/php-7.3.16"
66
67	All PHP 7.4.x users should upgrade to the latest version:
68
69	# emerge --sync
70	# emerge --ask --oneshot --verbose ">=dev-lang/php-7.4.4"
71
72	References
73	==========
74
75	[ 1 ] CVE-2018-19518
76	https://nvd.nist.gov/vuln/detail/CVE-2018-19518
77	[ 2 ] CVE-2020-7059
78	https://nvd.nist.gov/vuln/detail/CVE-2020-7059
79	[ 3 ] CVE-2020-7060
80	https://nvd.nist.gov/vuln/detail/CVE-2020-7060
81	[ 4 ] CVE-2020-7061
82	https://nvd.nist.gov/vuln/detail/CVE-2020-7061
83	[ 5 ] CVE-2020-7062
84	https://nvd.nist.gov/vuln/detail/CVE-2020-7062
85	[ 6 ] CVE-2020-7063
86	https://nvd.nist.gov/vuln/detail/CVE-2020-7063
87	[ 7 ] CVE-2020-7064
88	https://nvd.nist.gov/vuln/detail/CVE-2020-7064
89	[ 8 ] CVE-2020-7065
90	https://nvd.nist.gov/vuln/detail/CVE-2020-7065
91	[ 9 ] CVE-2020-7066
92	https://nvd.nist.gov/vuln/detail/CVE-2020-7066
93
94	Availability
95	============
96
97	This GLSA and any updates to it are available for viewing at
98	the Gentoo Security Website:
99
100	https://security.gentoo.org/glsa/202003-57
101
102	Concerns?
103	=========
104
105	Security is a primary focus of Gentoo Linux and ensuring the
106	confidentiality and security of our users' machines is of utmost
107	importance to us. Any security concerns should be addressed to
108	security@g.o or alternatively, you may file a bug at
109	https://bugs.gentoo.org.
110
111	License
112	=======
113
114	Copyright 2020 Gentoo Foundation, Inc; referenced text
115	belongs to its owner(s).
116
117	The contents of this document are licensed under the
118	Creative Commons - Attribution / Share Alike license.
119
120	https://creativecommons.org/licenses/by-sa/2.5