Security update for php5

Announcement ID:	SUSE-SU-2015:0868-1
Rating:	important
References:	bsc#922022 bsc#922451 bsc#922452 bsc#923946 bsc#924970 bsc#924972 bsc#925109 bsc#928408 bsc#928506 bsc#928511
Cross-References:	CVE-2014-9705 CVE-2014-9709 CVE-2015-2301 CVE-2015-2305 CVE-2015-2348 CVE-2015-2783 CVE-2015-2787 CVE-2015-3329 CVE-2015-3330
CVSS scores:
Affected Products:	SUSE Linux Enterprise Desktop 12 SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise High Performance Computing 12 SP3 SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 Web and Scripting Module 12

An update that solves nine vulnerabilities and has one security fix can now be installed.

Description:

PHP was updated to fix ten security issues.

The following vulnerabilities were fixed:

• CVE-2014-9709: A specially crafted GIF file could cause a buffer read overflow in php-gd (bnc#923946)
• CVE-2015-2301: Memory was use after it was freed in PHAR (bnc#922022)
• CVE-2015-2305: heap overflow vulnerability in regcomp.c (bnc#922452)
• CVE-2014-9705: heap buffer overflow in Enchant (bnc#922451)
• CVE-2015-2787: use-after-free vulnerability in the process_nested_data function (bnc#924972)
• unserialize SoapClient type confusion (bnc#925109)
• CVE-2015-2348: move_uploaded_file truncates a pathNAME upon encountering a x00 character (bnc#924970)
• CVE-2015-3330: Specially crafted PHAR files could, when executed under Apache httpd 2.4 (apache2handler), allow arbitrary code execution (bnc#928506)
• CVE-2015-3329: Specially crafted PHAR data could lead to disclosure of sensitive information due to a buffer overflow (bnc#928506)
• CVE-2015-2783: Specially crafted PHAR data could lead to disclosure of sensitive information due to a buffer over-read (bnc#928511)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• Web and Scripting Module 12
  zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2015-192=1
• SUSE Linux Enterprise Software Development Kit 12
  zypper in -t patch SUSE-SLE-SDK-12-2015-192=1

Package List:

• Web and Scripting Module 12 (ppc64le s390x x86_64)
  • php5-fileinfo-debuginfo-5.5.14-22.1
  • php5-gd-5.5.14-22.1
  • php5-sockets-5.5.14-22.1
  • php5-sysvmsg-debuginfo-5.5.14-22.1
  • php5-wddx-debuginfo-5.5.14-22.1
  • php5-openssl-5.5.14-22.1
  • php5-curl-5.5.14-22.1
  • php5-debuginfo-5.5.14-22.1
  • php5-xsl-5.5.14-22.1
  • php5-zip-5.5.14-22.1
  • php5-gmp-5.5.14-22.1
  • php5-ldap-5.5.14-22.1
  • php5-ctype-5.5.14-22.1
  • php5-tokenizer-5.5.14-22.1
  • php5-5.5.14-22.1
  • php5-gd-debuginfo-5.5.14-22.1
  • php5-curl-debuginfo-5.5.14-22.1
  • php5-sysvsem-5.5.14-22.1
  • php5-xmlreader-debuginfo-5.5.14-22.1
  • php5-sysvshm-5.5.14-22.1
  • php5-debugsource-5.5.14-22.1
  • php5-dba-5.5.14-22.1
  • php5-gettext-5.5.14-22.1
  • php5-odbc-5.5.14-22.1
  • php5-fastcgi-debuginfo-5.5.14-22.1
  • php5-pspell-debuginfo-5.5.14-22.1
  • php5-gettext-debuginfo-5.5.14-22.1
  • php5-calendar-5.5.14-22.1
  • php5-dom-5.5.14-22.1
  • php5-intl-debuginfo-5.5.14-22.1
  • php5-sysvsem-debuginfo-5.5.14-22.1
  • php5-pgsql-5.5.14-22.1
  • php5-pcntl-debuginfo-5.5.14-22.1
  • php5-soap-5.5.14-22.1
  • php5-dom-debuginfo-5.5.14-22.1
  • php5-iconv-5.5.14-22.1
  • php5-bcmath-5.5.14-22.1
  • php5-json-5.5.14-22.1
  • php5-odbc-debuginfo-5.5.14-22.1
  • php5-soap-debuginfo-5.5.14-22.1
  • php5-mbstring-debuginfo-5.5.14-22.1
  • php5-ldap-debuginfo-5.5.14-22.1
  • php5-gmp-debuginfo-5.5.14-22.1
  • php5-xsl-debuginfo-5.5.14-22.1
  • php5-suhosin-debuginfo-5.5.14-22.1
  • php5-fpm-5.5.14-22.1
  • php5-zlib-debuginfo-5.5.14-22.1
  • php5-ftp-debuginfo-5.5.14-22.1
  • php5-fileinfo-5.5.14-22.1
  • php5-sysvshm-debuginfo-5.5.14-22.1
  • php5-bz2-debuginfo-5.5.14-22.1
  • php5-mysql-debuginfo-5.5.14-22.1
  • php5-ctype-debuginfo-5.5.14-22.1
  • php5-pdo-debuginfo-5.5.14-22.1
  • php5-zlib-5.5.14-22.1
  • php5-sqlite-debuginfo-5.5.14-22.1
  • php5-xmlreader-5.5.14-22.1
  • php5-suhosin-5.5.14-22.1
  • php5-enchant-5.5.14-22.1
  • apache2-mod_php5-debuginfo-5.5.14-22.1
  • php5-fpm-debuginfo-5.5.14-22.1
  • php5-xmlrpc-debuginfo-5.5.14-22.1
  • php5-snmp-5.5.14-22.1
  • php5-openssl-debuginfo-5.5.14-22.1
  • php5-pspell-5.5.14-22.1
  • php5-iconv-debuginfo-5.5.14-22.1
  • php5-bz2-5.5.14-22.1
  • php5-intl-5.5.14-22.1
  • php5-enchant-debuginfo-5.5.14-22.1
  • php5-sqlite-5.5.14-22.1
  • php5-exif-5.5.14-22.1
  • php5-snmp-debuginfo-5.5.14-22.1
  • php5-mcrypt-debuginfo-5.5.14-22.1
  • php5-ftp-5.5.14-22.1
  • php5-mbstring-5.5.14-22.1
  • php5-dba-debuginfo-5.5.14-22.1
  • php5-tokenizer-debuginfo-5.5.14-22.1
  • php5-zip-debuginfo-5.5.14-22.1
  • php5-sockets-debuginfo-5.5.14-22.1
  • php5-sysvmsg-5.5.14-22.1
  • php5-xmlwriter-5.5.14-22.1
  • php5-wddx-5.5.14-22.1
  • php5-json-debuginfo-5.5.14-22.1
  • php5-bcmath-debuginfo-5.5.14-22.1
  • apache2-mod_php5-5.5.14-22.1
  • php5-shmop-debuginfo-5.5.14-22.1
  • php5-pcntl-5.5.14-22.1
  • php5-calendar-debuginfo-5.5.14-22.1
  • php5-pgsql-debuginfo-5.5.14-22.1
  • php5-shmop-5.5.14-22.1
  • php5-mcrypt-5.5.14-22.1
  • php5-xmlwriter-debuginfo-5.5.14-22.1
  • php5-pdo-5.5.14-22.1
  • php5-fastcgi-5.5.14-22.1
  • php5-xmlrpc-5.5.14-22.1
  • php5-mysql-5.5.14-22.1
  • php5-exif-debuginfo-5.5.14-22.1
• Web and Scripting Module 12 (noarch)
  • php5-pear-5.5.14-22.1
• SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64)
  • php5-debugsource-5.5.14-22.1
  • php5-debuginfo-5.5.14-22.1
  • php5-devel-5.5.14-22.1

References:

• https://www.suse.com/security/cve/CVE-2014-9705.html
• https://www.suse.com/security/cve/CVE-2014-9709.html
• https://www.suse.com/security/cve/CVE-2015-2301.html
• https://www.suse.com/security/cve/CVE-2015-2305.html
• https://www.suse.com/security/cve/CVE-2015-2348.html
• https://www.suse.com/security/cve/CVE-2015-2783.html
• https://www.suse.com/security/cve/CVE-2015-2787.html
• https://www.suse.com/security/cve/CVE-2015-3329.html
• https://www.suse.com/security/cve/CVE-2015-3330.html
• https://bugzilla.suse.com/show_bug.cgi?id=922022
• https://bugzilla.suse.com/show_bug.cgi?id=922451
• https://bugzilla.suse.com/show_bug.cgi?id=922452
• https://bugzilla.suse.com/show_bug.cgi?id=923946
• https://bugzilla.suse.com/show_bug.cgi?id=924970
• https://bugzilla.suse.com/show_bug.cgi?id=924972
• https://bugzilla.suse.com/show_bug.cgi?id=925109
• https://bugzilla.suse.com/show_bug.cgi?id=928408
• https://bugzilla.suse.com/show_bug.cgi?id=928506
• https://bugzilla.suse.com/show_bug.cgi?id=928511