Security update for php5

Announcement ID:	SUSE-SU-2020:0522-1
Rating:	moderate
References:	bsc#1145095 bsc#1146360 bsc#1154999 bsc#1159922 bsc#1159923 bsc#1159924 bsc#1159927 bsc#1161982 bsc#1162629 bsc#1162632
Cross-References:	CVE-2019-11041 CVE-2019-11042 CVE-2019-11043 CVE-2019-11045 CVE-2019-11046 CVE-2019-11047 CVE-2019-11050 CVE-2020-7059 CVE-2020-7060
CVSS scores:	CVE-2019-11041 ( SUSE ): 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-11041 ( NVD ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CVE-2019-11041 ( NVD ): 4.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2019-11042 ( SUSE ): 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L CVE-2019-11042 ( NVD ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H CVE-2019-11042 ( NVD ): 4.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2019-11043 ( SUSE ): 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-11043 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-11045 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2019-11045 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2019-11046 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2019-11046 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2019-11047 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2019-11047 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2019-11050 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2019-11050 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVE-2020-7059 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2020-7059 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H CVE-2020-7060 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2020-7060 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Affected Products:	SUSE Linux Enterprise Desktop 12 SP4 SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise High Performance Computing 12 SP3 SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP4 Web and Scripting Module 12

An update that solves nine vulnerabilities and has one security fix can now be installed.

Description:

This update for php5 fixes the following issues:

Security issues fixed:

• CVE-2019-11041: Fixed heap buffer over-read in exif_scan_thumbnail() (bsc#1146360).
• CVE-2019-11042: Fixed heap buffer over-read in exif_process_user_comment() (bsc#1145095).
• CVE-2019-11043: Fixed possible remote code execution via env_path_info underflow in fpm_main.c (bsc#1154999).
• CVE-2019-11045: Fixed an issue with the PHP DirectoryIterator class that accepts filenames with embedded \0 bytes (bsc#1159923).
• CVE-2019-11046: Fixed an out-of-bounds read in bc_shift_addsub (bsc#1159924).
• CVE-2019-11047: Fixed an information disclosure in exif_read_data (bsc#1159922).
• CVE-2019-11050: Fixed a buffer over-read in the EXIF extension (bsc#1159927).
• CVE-2020-7059: Fixed an out-of-bounds read in php_strip_tags_ex (bsc#1162629).
• CVE-2020-7060: Fixed a global buffer-overflow in mbfl_filt_conv_big5_wchar (bsc#1162632).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• Web and Scripting Module 12
  zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2020-522=1
• SUSE Linux Enterprise Software Development Kit 12 SP4
  zypper in -t patch SUSE-SLE-SDK-12-SP4-2020-522=1

Package List:

• Web and Scripting Module 12 (aarch64 ppc64le s390x x86_64)
  • php5-mcrypt-debuginfo-5.5.14-109.68.1
  • php5-sockets-debuginfo-5.5.14-109.68.1
  • php5-pspell-debuginfo-5.5.14-109.68.1
  • php5-bz2-debuginfo-5.5.14-109.68.1
  • php5-zip-debuginfo-5.5.14-109.68.1
  • php5-fpm-5.5.14-109.68.1
  • php5-iconv-5.5.14-109.68.1
  • php5-enchant-5.5.14-109.68.1
  • php5-pcntl-debuginfo-5.5.14-109.68.1
  • php5-fpm-debuginfo-5.5.14-109.68.1
  • php5-wddx-debuginfo-5.5.14-109.68.1
  • php5-ftp-debuginfo-5.5.14-109.68.1
  • php5-tokenizer-5.5.14-109.68.1
  • php5-odbc-debuginfo-5.5.14-109.68.1
  • php5-ctype-debuginfo-5.5.14-109.68.1
  • php5-exif-debuginfo-5.5.14-109.68.1
  • php5-intl-5.5.14-109.68.1
  • php5-gmp-debuginfo-5.5.14-109.68.1
  • apache2-mod_php5-debuginfo-5.5.14-109.68.1
  • php5-opcache-debuginfo-5.5.14-109.68.1
  • php5-curl-5.5.14-109.68.1
  • php5-fileinfo-5.5.14-109.68.1
  • php5-pdo-5.5.14-109.68.1
  • php5-calendar-5.5.14-109.68.1
  • php5-pcntl-5.5.14-109.68.1
  • php5-pspell-5.5.14-109.68.1
  • php5-sockets-5.5.14-109.68.1
  • php5-mbstring-debuginfo-5.5.14-109.68.1
  • php5-opcache-5.5.14-109.68.1
  • php5-sysvshm-5.5.14-109.68.1
  • php5-fileinfo-debuginfo-5.5.14-109.68.1
  • php5-phar-5.5.14-109.68.1
  • php5-json-debuginfo-5.5.14-109.68.1
  • php5-sysvsem-debuginfo-5.5.14-109.68.1
  • php5-xmlrpc-debuginfo-5.5.14-109.68.1
  • php5-ftp-5.5.14-109.68.1
  • php5-posix-debuginfo-5.5.14-109.68.1
  • php5-xmlrpc-5.5.14-109.68.1
  • php5-dom-debuginfo-5.5.14-109.68.1
  • php5-debugsource-5.5.14-109.68.1
  • php5-wddx-5.5.14-109.68.1
  • php5-xmlwriter-5.5.14-109.68.1
  • php5-posix-5.5.14-109.68.1
  • php5-dba-5.5.14-109.68.1
  • php5-xmlreader-5.5.14-109.68.1
  • php5-odbc-5.5.14-109.68.1
  • php5-gmp-5.5.14-109.68.1
  • php5-exif-5.5.14-109.68.1
  • php5-phar-debuginfo-5.5.14-109.68.1
  • php5-fastcgi-5.5.14-109.68.1
  • php5-soap-5.5.14-109.68.1
  • php5-gettext-5.5.14-109.68.1
  • php5-mysql-5.5.14-109.68.1
  • php5-sqlite-5.5.14-109.68.1
  • php5-shmop-debuginfo-5.5.14-109.68.1
  • php5-xmlreader-debuginfo-5.5.14-109.68.1
  • php5-xmlwriter-debuginfo-5.5.14-109.68.1
  • php5-bcmath-5.5.14-109.68.1
  • php5-fastcgi-debuginfo-5.5.14-109.68.1
  • php5-calendar-debuginfo-5.5.14-109.68.1
  • php5-tokenizer-debuginfo-5.5.14-109.68.1
  • php5-pgsql-5.5.14-109.68.1
  • php5-ldap-5.5.14-109.68.1
  • php5-ldap-debuginfo-5.5.14-109.68.1
  • php5-gettext-debuginfo-5.5.14-109.68.1
  • php5-bz2-5.5.14-109.68.1
  • php5-bcmath-debuginfo-5.5.14-109.68.1
  • php5-pgsql-debuginfo-5.5.14-109.68.1
  • php5-xsl-debuginfo-5.5.14-109.68.1
  • php5-dba-debuginfo-5.5.14-109.68.1
  • php5-debuginfo-5.5.14-109.68.1
  • php5-zlib-debuginfo-5.5.14-109.68.1
  • php5-snmp-debuginfo-5.5.14-109.68.1
  • php5-sysvmsg-5.5.14-109.68.1
  • php5-5.5.14-109.68.1
  • php5-sysvmsg-debuginfo-5.5.14-109.68.1
  • php5-intl-debuginfo-5.5.14-109.68.1
  • php5-shmop-5.5.14-109.68.1
  • php5-suhosin-5.5.14-109.68.1
  • php5-zip-5.5.14-109.68.1
  • php5-json-5.5.14-109.68.1
  • apache2-mod_php5-5.5.14-109.68.1
  • php5-suhosin-debuginfo-5.5.14-109.68.1
  • php5-imap-debuginfo-5.5.14-109.68.1
  • php5-ctype-5.5.14-109.68.1
  • php5-sqlite-debuginfo-5.5.14-109.68.1
  • php5-mcrypt-5.5.14-109.68.1
  • php5-imap-5.5.14-109.68.1
  • php5-openssl-debuginfo-5.5.14-109.68.1
  • php5-sysvsem-5.5.14-109.68.1
  • php5-zlib-5.5.14-109.68.1
  • php5-dom-5.5.14-109.68.1
  • php5-pdo-debuginfo-5.5.14-109.68.1
  • php5-sysvshm-debuginfo-5.5.14-109.68.1
  • php5-snmp-5.5.14-109.68.1
  • php5-gd-5.5.14-109.68.1
  • php5-iconv-debuginfo-5.5.14-109.68.1
  • php5-mysql-debuginfo-5.5.14-109.68.1
  • php5-mbstring-5.5.14-109.68.1
  • php5-openssl-5.5.14-109.68.1
  • php5-curl-debuginfo-5.5.14-109.68.1
  • php5-enchant-debuginfo-5.5.14-109.68.1
  • php5-gd-debuginfo-5.5.14-109.68.1
  • php5-soap-debuginfo-5.5.14-109.68.1
  • php5-xsl-5.5.14-109.68.1
• Web and Scripting Module 12 (noarch)
  • php5-pear-5.5.14-109.68.1
• SUSE Linux Enterprise Software Development Kit 12 SP4 (aarch64 ppc64le s390x x86_64)
  • php5-devel-5.5.14-109.68.1
  • php5-debuginfo-5.5.14-109.68.1
  • php5-debugsource-5.5.14-109.68.1

References:

• https://www.suse.com/security/cve/CVE-2019-11041.html
• https://www.suse.com/security/cve/CVE-2019-11042.html
• https://www.suse.com/security/cve/CVE-2019-11043.html
• https://www.suse.com/security/cve/CVE-2019-11045.html
• https://www.suse.com/security/cve/CVE-2019-11046.html
• https://www.suse.com/security/cve/CVE-2019-11047.html
• https://www.suse.com/security/cve/CVE-2019-11050.html
• https://www.suse.com/security/cve/CVE-2020-7059.html
• https://www.suse.com/security/cve/CVE-2020-7060.html
• https://bugzilla.suse.com/show_bug.cgi?id=1145095
• https://bugzilla.suse.com/show_bug.cgi?id=1146360
• https://bugzilla.suse.com/show_bug.cgi?id=1154999
• https://bugzilla.suse.com/show_bug.cgi?id=1159922
• https://bugzilla.suse.com/show_bug.cgi?id=1159923
• https://bugzilla.suse.com/show_bug.cgi?id=1159924
• https://bugzilla.suse.com/show_bug.cgi?id=1159927
• https://bugzilla.suse.com/show_bug.cgi?id=1161982
• https://bugzilla.suse.com/show_bug.cgi?id=1162629
• https://bugzilla.suse.com/show_bug.cgi?id=1162632