diff options
| author | Jason Unovitch <junovitch@FreeBSD.org> | 2016-06-25 22:18:23 +0000 |
|---|---|---|
| committer | Jason Unovitch <junovitch@FreeBSD.org> | 2016-06-25 22:18:23 +0000 |
| commit | 777e8f5f5c1fa4954e4a0912814984eec1d26464 (patch) | |
| tree | 71e07545df36ce48e6c8bb1e1e0bc9ac15cd6d27 | |
| parent | 184c8df6736a0134fb56ecfd2961ff4080e8929e (diff) | |
| download | ports-777e8f5f5c1fa4954e4a0912814984eec1d26464.tar.gz ports-777e8f5f5c1fa4954e4a0912814984eec1d26464.zip | |
Docment security issues fixed in PHP 7.0.8, 5.6.23, and 5.5.37
PR: 210491
PR: 210502
Reported by: Vladimir Krstulja <vlad-fbsd@acheronmedia.com>
Reported by: Philip Jocks <freebsdbugs@filis.org>
Security: CVE-2015-8874
Security: CVE-2016-5766
Security: CVE-2016-5767
Security: CVE-2016-5768
Security: CVE-2016-5769
Security: CVE-2016-5770
Security: CVE-2016-5771
Security: CVE-2016-5772
Security: CVE-2016-5773
Security: https://vuxml.FreeBSD.org/freebsd/66d77c58-3b1d-11e6-8e82-002590263bf5.html
Notes
Notes:
svn path=/head/; revision=417490
| -rw-r--r-- | security/vuxml/vuln.xml | 114 |
1 files changed, 114 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 3b4c30855885..a544db834657 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,120 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="66d77c58-3b1d-11e6-8e82-002590263bf5"> + <topic>php -- multiple vulnerabilities</topic> + <affects> + <package> + <name>php55</name> + <name>php55-gd</name> + <name>php55-mbstring</name> + <name>php55-wddx</name> + <name>php55-zip</name> + <range><lt>5.5.37</lt></range> + </package> + <package> + <name>php56</name> + <name>php56-gd</name> + <name>php56-mbstring</name> + <name>php56-phar</name> + <name>php56-wddx</name> + <name>php56-zip</name> + <range><lt>5.6.23</lt></range> + </package> + <package> + <name>php70</name> + <name>php70-gd</name> + <name>php70-mbstring</name> + <name>php70-phar</name> + <name>php70-wddx</name> + <name>php70-zip</name> + <range><lt>7.0.8</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>The PHP Group reports:</p> + <blockquote cite="http://php.net/ChangeLog-5.php#5.5.37"> + <ul><li>Core: + <ul> + <li>Fixed bug #72268 (Integer Overflow in nl2br())</li> + <li>Fixed bug #72275 (Integer Overflow in json_encode()/ + json_decode()/ json_utf8_to_utf16())</li> + <li>Fixed bug #72400 (Integer Overflow in addcslashes/ + addslashes)</li> + <li>Fixed bug #72403 (Integer Overflow in Length of String-typed + ZVAL)</li> + </ul></li> + <li>GD: + <ul> + <li>Fixed bug #66387 (Stack overflow with imagefilltoborder) + (CVE-2015-8874)</li> + <li>Fixed bug #72298 (pass2_no_dither out-of-bounds access)</li> + <li>Fixed bug #72339 (Integer Overflow in _gd2GetHeader() resulting + in heap overflow) (CVE-2016-5766)</li> + <li>Fixed bug #72407 (NULL Pointer Dereference at _gdScaleVert)</li> + <li>Fixed bug #72446 (Integer Overflow in + gdImagePaletteToTrueColor() resulting in heap overflow) + (CVE-2016-5767)</li> + </ul></li> + <li>mbstring: + <ul> + <li>Fixed bug #72402 (_php_mb_regex_ereg_replace_exec - double free) + (CVE-2016-5768)</li> + </ul></li> + <li>mcrypt: + <ul> + <li>Fixed bug #72455 (Heap Overflow due to integer overflows) + (CVE-2016-5769)</li> + </ul></li> + <li>Phar: + <ul> + <li>Fixed bug #72321 (invalid free in phar_extract_file()). (PHP + 5.6/7.0 only)</li> + </ul></li> + <li>SPL: + <ul> + <li>Fixed bug #72262 (int/size_t confusion in SplFileObject::fread) + (CVE-2016-5770)</li> + <li>Fixed bug #72433 (Use After Free Vulnerability in PHP's GC + algorithm and unserialize) (CVE-2016-5771)</li> + </ul></li> + <li>WDDX: + <ul> + <li>Fixed bug #72340 (Double Free Courruption in wddx_deserialize) + (CVE-2016-5772)</li> + </ul></li> + <li>zip: + <ul> + <li>Fixed bug #72434 (ZipArchive class Use After Free Vulnerability + in PHP's GC algorithm and unserialize). (CVE-2016-5773)</li> + </ul></li> + </ul> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2015-8874</cvename> + <cvename>CVE-2016-5766</cvename> + <cvename>CVE-2016-5767</cvename> + <cvename>CVE-2016-5768</cvename> + <cvename>CVE-2016-5769</cvename> + <cvename>CVE-2016-5770</cvename> + <cvename>CVE-2016-5771</cvename> + <cvename>CVE-2016-5772</cvename> + <cvename>CVE-2016-5773</cvename> + <freebsdpr>ports/210491</freebsdpr> + <freebsdpr>ports/210502</freebsdpr> + <url>http://php.net/ChangeLog-5.php#5.5.37</url> + <url>http://php.net/ChangeLog-5.php#5.6.23</url> + <url>http://php.net/ChangeLog-7.php#7.0.8</url> + </references> + <dates> + <discovery>2016-06-23</discovery> + <entry>2016-06-25</entry> + </dates> + </vuln> + <vuln vid="4a0d9b53-395d-11e6-b3c8-14dae9d210b8"> <topic>libarchive -- multiple vulnerabilities</topic> <affects> |