shield Security update for php5

SUSE-SLE-Module-Web-Scripting-12-2016-1082

This update for php5 fixes the following issues: * It is possible to launch a web server with "php -S localhost:8080" It used to be possible to set an arbitrary $HTTP_PROXY environment variable for request handlers -- like CGI scripts -- by including a specially crafted HTTP header in the request (CVE-2016-5385). As a result, these server components would potentially direct all their outgoing HTTP traffic through a malicious proxy server. This patch fixes the issue: the updated php server ignores such HTTP headers and never sets $HTTP_PROXY for sub-processes. (bnc#988486) * There was multiple cases where a remote attacker could trigger a double free and, given specific PHP code using callbacks, trigger code execution vectors. (bnc#986246,bnc#986244,CVE-2016-5768,CVE-2016-5772) * It was possible to inject header or content information (XSS) when a user was using internet explorer as the browser. (bnc#986004, CVE-2015-8935) * In several cases it was possible for a integer overflow to trigger an excessive memory allocation (bnc#986392, bnc#986388, bnc#986386, bnc#986393, CVE-2016-5770, CVE-2016-5769, CVE-2016-5766, CVE-2016-5767) * It was possible for an attacker to abuse the garbage collector to free a target array. At this point an attacker could craft a fake zval object and exploit the PHP process by taking over the EIP/RIP. (bnc#986391, CVE-2016-5771)

• Release Date
  Jul 20 2016
• References
  Bugzilla: 986246, 986244, 986004, 986392, 986391, 986388, 986386, 986393, 988486
  CVEs: CVE-2016-5385, CVE-2016-5768, CVE-2016-5772, CVE-2015-8935, CVE-2016-5770, CVE-2016-5771, CVE-2016-5769, CVE-2016-5766, CVE-2016-5767
• Type
  security
• Severity
  moderate

cloud_download Downloads

Web and Scripting Module 12 x86_64

• Packages
  apache2-mod_php5
  PHP5 Module for Apache 2.0

  5.5.14-68.1 lock rpm

  php5
  PHP5 Core Files

  5.5.14-68.1 lock rpm lock src

  php5-bcmath
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-bz2
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-calendar
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-ctype
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-curl
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-dba
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-dom
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-enchant
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-exif
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-fastcgi
  FastCGI PHP5 Module

  5.5.14-68.1 lock rpm

  php5-fileinfo
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-fpm
  FastCGI Process Manager PHP5 Module

  5.5.14-68.1 lock rpm

  php5-ftp
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-gd
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-gettext
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-gmp
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-iconv
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-imap
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-intl
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-json
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-ldap
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-mbstring
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-mcrypt
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-mysql
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-odbc
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-opcache
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-openssl
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-pcntl
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-pdo
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-pear
  PHP Extension and Application Repository

  5.5.14-68.1 lock rpm

  php5-pgsql
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-phar
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-posix
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-pspell
  PHP5 pspell extension

  5.5.14-68.1 lock rpm

  php5-shmop
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-snmp
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-soap
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-sockets
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-sqlite
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-suhosin
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-sysvmsg
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-sysvsem
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-sysvshm
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-tokenizer
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-wddx
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-xmlreader
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-xmlrpc
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-xmlwriter
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-xsl
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-zip
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-zlib
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

Web and Scripting Module 12 ppc64le

• Packages
  apache2-mod_php5
  PHP5 Module for Apache 2.0

  5.5.14-68.1 lock rpm

  php5
  PHP5 Core Files

  5.5.14-68.1 lock rpm lock src

  php5-bcmath
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-bz2
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-calendar
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-ctype
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-curl
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-dba
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-dom
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-enchant
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-exif
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-fastcgi
  FastCGI PHP5 Module

  5.5.14-68.1 lock rpm

  php5-fileinfo
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-fpm
  FastCGI Process Manager PHP5 Module

  5.5.14-68.1 lock rpm

  php5-ftp
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-gd
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-gettext
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-gmp
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-iconv
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-imap
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-intl
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-json
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-ldap
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-mbstring
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-mcrypt
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-mysql
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-odbc
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-opcache
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-openssl
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-pcntl
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-pdo
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-pear
  PHP Extension and Application Repository

  5.5.14-68.1 lock rpm

  php5-pgsql
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-phar
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-posix
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-pspell
  PHP5 pspell extension

  5.5.14-68.1 lock rpm

  php5-shmop
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-snmp
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-soap
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-sockets
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-sqlite
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-suhosin
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-sysvmsg
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-sysvsem
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-sysvshm
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-tokenizer
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-wddx
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-xmlreader
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-xmlrpc
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-xmlwriter
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-xsl
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-zip
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-zlib
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

Web and Scripting Module 12 s390x

• Packages
  apache2-mod_php5
  PHP5 Module for Apache 2.0

  5.5.14-68.1 lock rpm

  php5
  PHP5 Core Files

  5.5.14-68.1 lock rpm lock src

  php5-bcmath
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-bz2
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-calendar
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-ctype
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-curl
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-dba
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-dom
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-enchant
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-exif
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-fastcgi
  FastCGI PHP5 Module

  5.5.14-68.1 lock rpm

  php5-fileinfo
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-fpm
  FastCGI Process Manager PHP5 Module

  5.5.14-68.1 lock rpm

  php5-ftp
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-gd
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-gettext
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-gmp
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-iconv
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-imap
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-intl
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-json
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-ldap
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-mbstring
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-mcrypt
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-mysql
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-odbc
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-opcache
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-openssl
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-pcntl
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-pdo
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-pear
  PHP Extension and Application Repository

  5.5.14-68.1 lock rpm

  php5-pgsql
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-phar
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-posix
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-pspell
  PHP5 pspell extension

  5.5.14-68.1 lock rpm

  php5-shmop
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-snmp
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-soap
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-sockets
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-sqlite
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-suhosin
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-sysvmsg
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-sysvsem
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-sysvshm
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-tokenizer
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-wddx
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-xmlreader
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-xmlrpc
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-xmlwriter
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-xsl
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-zip
  PHP5 Extension Module

  5.5.14-68.1 lock rpm

  php5-zlib
  PHP5 Extension Module

  5.5.14-68.1 lock rpm