Oval Definition:	oval:com.redhat.rhsa:def:20162598
Revision Date: 2016-11-03 Version: 641 Title: RHSA-2016:2598: php security and bug fix update (Moderate) Description: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): A flaw was found in the way certain error conditions were handled by bzread() function in PHP. An attacker could use this flaw to upload a specially crafted bz2 archive which, when parsed via the vulnerable function, could cause the application to crash or execute arbitrary code with the permissions of the user running the PHP application. (CVE-2016-5399) An integer overflow flaw, leading to a heap-based buffer overflow was found in the imagecreatefromgd2() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application using gd via a specially crafted GD2 image. (CVE-2016-5766) An integer overflow flaw, leading to a heap-based buffer overflow was found in the gdImagePaletteToTrueColor() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application using gd via a specially crafted image buffer. (CVE-2016-5767) A double free flaw was found in the mb_ereg_replace_callback() function of php which is used to perform regex search. This flaw could possibly cause a PHP application to crash. (CVE-2016-5768) Red Hat would like to thank Hans Jerry Illikainen for reporting CVE-2016-5399. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section. Family: unix Class: patch Status: Reference(s): CVE-2016-5399 CVE-2016-5766 CVE-2016-5767 CVE-2016-5768 RHSA-2016:2598 RHSA-2016:2598-01 RHSA-2016:2598-02 RHSA-2016:2598-02 Platform(s): Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 7 (please do not use for >= RHEL-7.5) Product(s): Definition Synopsis Red Hat Enterprise Linux must be installed OR Package Information Red Hat Enterprise Linux 7 is installed AND php is earlier than 0:5.4.16-42.el7 AND php is signed with Red Hat redhatrelease2 key php-bcmath is earlier than 0:5.4.16-42.el7 AND php-bcmath is signed with Red Hat redhatrelease2 key php-cli is earlier than 0:5.4.16-42.el7 AND php-cli is signed with Red Hat redhatrelease2 key php-common is earlier than 0:5.4.16-42.el7 AND php-common is signed with Red Hat redhatrelease2 key php-dba is earlier than 0:5.4.16-42.el7 AND php-dba is signed with Red Hat redhatrelease2 key php-devel is earlier than 0:5.4.16-42.el7 AND php-devel is signed with Red Hat redhatrelease2 key php-embedded is earlier than 0:5.4.16-42.el7 AND php-embedded is signed with Red Hat redhatrelease2 key php-enchant is earlier than 0:5.4.16-42.el7 AND php-enchant is signed with Red Hat redhatrelease2 key php-fpm is earlier than 0:5.4.16-42.el7 AND php-fpm is signed with Red Hat redhatrelease2 key php-gd is earlier than 0:5.4.16-42.el7 AND php-gd is signed with Red Hat redhatrelease2 key php-intl is earlier than 0:5.4.16-42.el7 AND php-intl is signed with Red Hat redhatrelease2 key php-ldap is earlier than 0:5.4.16-42.el7 AND php-ldap is signed with Red Hat redhatrelease2 key php-mbstring is earlier than 0:5.4.16-42.el7 AND php-mbstring is signed with Red Hat redhatrelease2 key php-mysql is earlier than 0:5.4.16-42.el7 AND php-mysql is signed with Red Hat redhatrelease2 key php-mysqlnd is earlier than 0:5.4.16-42.el7 AND php-mysqlnd is signed with Red Hat redhatrelease2 key php-odbc is earlier than 0:5.4.16-42.el7 AND php-odbc is signed with Red Hat redhatrelease2 key php-pdo is earlier than 0:5.4.16-42.el7 AND php-pdo is signed with Red Hat redhatrelease2 key php-pgsql is earlier than 0:5.4.16-42.el7 AND php-pgsql is signed with Red Hat redhatrelease2 key php-process is earlier than 0:5.4.16-42.el7 AND php-process is signed with Red Hat redhatrelease2 key php-pspell is earlier than 0:5.4.16-42.el7 AND php-pspell is signed with Red Hat redhatrelease2 key php-recode is earlier than 0:5.4.16-42.el7 AND php-recode is signed with Red Hat redhatrelease2 key php-snmp is earlier than 0:5.4.16-42.el7 AND php-snmp is signed with Red Hat redhatrelease2 key php-soap is earlier than 0:5.4.16-42.el7 AND php-soap is signed with Red Hat redhatrelease2 key php-xml is earlier than 0:5.4.16-42.el7 AND php-xml is signed with Red Hat redhatrelease2 key php-xmlrpc is earlier than 0:5.4.16-42.el7 AND php-xmlrpc is signed with Red Hat redhatrelease2 key Definition Synopsis Release Information Red Hat Enterprise Linux 7 Client is installed OR Red Hat Enterprise Linux 7 Server is installed OR Red Hat Enterprise Linux 7 Workstation is installed OR Red Hat Enterprise Linux 7 ComputeNode is installed AND Package Information php-xml is earlier than 0:5.4.16-42.el7 AND php-xml is signed with Red Hat redhatrelease2 key OR php-recode is earlier than 0:5.4.16-42.el7 AND php-recode is signed with Red Hat redhatrelease2 key OR php-fpm is earlier than 0:5.4.16-42.el7 AND php-fpm is signed with Red Hat redhatrelease2 key OR php-pdo is earlier than 0:5.4.16-42.el7 AND php-pdo is signed with Red Hat redhatrelease2 key OR php-bcmath is earlier than 0:5.4.16-42.el7 AND php-bcmath is signed with Red Hat redhatrelease2 key OR php-process is earlier than 0:5.4.16-42.el7 AND php-process is signed with Red Hat redhatrelease2 key OR php-soap is earlier than 0:5.4.16-42.el7 AND php-soap is signed with Red Hat redhatrelease2 key OR php-pgsql is earlier than 0:5.4.16-42.el7 AND php-pgsql is signed with Red Hat redhatrelease2 key OR php-odbc is earlier than 0:5.4.16-42.el7 AND php-odbc is signed with Red Hat redhatrelease2 key OR php-gd is earlier than 0:5.4.16-42.el7 AND php-gd is signed with Red Hat redhatrelease2 key OR php-snmp is earlier than 0:5.4.16-42.el7 AND php-snmp is signed with Red Hat redhatrelease2 key OR php is earlier than 0:5.4.16-42.el7 AND php is signed with Red Hat redhatrelease2 key OR php-ldap is earlier than 0:5.4.16-42.el7 AND php-ldap is signed with Red Hat redhatrelease2 key OR php-devel is earlier than 0:5.4.16-42.el7 AND php-devel is signed with Red Hat redhatrelease2 key OR php-cli is earlier than 0:5.4.16-42.el7 AND php-cli is signed with Red Hat redhatrelease2 key OR php-enchant is earlier than 0:5.4.16-42.el7 AND php-enchant is signed with Red Hat redhatrelease2 key OR php-mysql is earlier than 0:5.4.16-42.el7 AND php-mysql is signed with Red Hat redhatrelease2 key OR php-pspell is earlier than 0:5.4.16-42.el7 AND php-pspell is signed with Red Hat redhatrelease2 key OR php-embedded is earlier than 0:5.4.16-42.el7 AND php-embedded is signed with Red Hat redhatrelease2 key OR php-xmlrpc is earlier than 0:5.4.16-42.el7 AND php-xmlrpc is signed with Red Hat redhatrelease2 key OR php-intl is earlier than 0:5.4.16-42.el7 AND php-intl is signed with Red Hat redhatrelease2 key OR php-mbstring is earlier than 0:5.4.16-42.el7 AND php-mbstring is signed with Red Hat redhatrelease2 key OR php-mysqlnd is earlier than 0:5.4.16-42.el7 AND php-mysqlnd is signed with Red Hat redhatrelease2 key OR php-dba is earlier than 0:5.4.16-42.el7 AND php-dba is signed with Red Hat redhatrelease2 key OR php-common is earlier than 0:5.4.16-42.el7 AND php-common is signed with Red Hat redhatrelease2 key
BACK