Security update for php5 SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2017:1757-1 Final 1 1 2017-07-03T06:31:05Z current 2017-07-03T06:31:05Z 2017-07-03T06:31:05Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for php5 This update for php5 fixes the following security issues: - CVE-2016-6294: The locale_accept_from_http function in ext/intl/locale/locale_methods.c did not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allowed remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument (bsc#1035111). - CVE-2017-9227: A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. (bsc#1040883) - CVE-2017-9226: A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. (bsc#1040889) - CVE-2017-9224: A stack out-of-bounds read occurs in match_at() during regular expression searching. (bsc#1040891) This update was imported from the SUSE:SLE-12:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2017-07/msg00011.html E-Mail link for openSUSE-SU-2017:1757-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.2 apache2-mod_php5-5.5.14-77.6.1 php5-5.5.14-77.6.1 php5-bcmath-5.5.14-77.6.1 php5-bz2-5.5.14-77.6.1 php5-calendar-5.5.14-77.6.1 php5-ctype-5.5.14-77.6.1 php5-curl-5.5.14-77.6.1 php5-dba-5.5.14-77.6.1 php5-devel-5.5.14-77.6.1 php5-dom-5.5.14-77.6.1 php5-enchant-5.5.14-77.6.1 php5-exif-5.5.14-77.6.1 php5-fastcgi-5.5.14-77.6.1 php5-fileinfo-5.5.14-77.6.1 php5-firebird-5.5.14-77.6.1 php5-fpm-5.5.14-77.6.1 php5-ftp-5.5.14-77.6.1 php5-gd-5.5.14-77.6.1 php5-gettext-5.5.14-77.6.1 php5-gmp-5.5.14-77.6.1 php5-iconv-5.5.14-77.6.1 php5-imap-5.5.14-77.6.1 php5-intl-5.5.14-77.6.1 php5-json-5.5.14-77.6.1 php5-ldap-5.5.14-77.6.1 php5-mbstring-5.5.14-77.6.1 php5-mcrypt-5.5.14-77.6.1 php5-mssql-5.5.14-77.6.1 php5-mysql-5.5.14-77.6.1 php5-odbc-5.5.14-77.6.1 php5-opcache-5.5.14-77.6.1 php5-openssl-5.5.14-77.6.1 php5-pcntl-5.5.14-77.6.1 php5-pdo-5.5.14-77.6.1 php5-pear-5.5.14-77.6.1 php5-pgsql-5.5.14-77.6.1 php5-phar-5.5.14-77.6.1 php5-posix-5.5.14-77.6.1 php5-pspell-5.5.14-77.6.1 php5-readline-5.5.14-77.6.1 php5-shmop-5.5.14-77.6.1 php5-snmp-5.5.14-77.6.1 php5-soap-5.5.14-77.6.1 php5-sockets-5.5.14-77.6.1 php5-sqlite-5.5.14-77.6.1 php5-suhosin-5.5.14-77.6.1 php5-sysvmsg-5.5.14-77.6.1 php5-sysvsem-5.5.14-77.6.1 php5-sysvshm-5.5.14-77.6.1 php5-tidy-5.5.14-77.6.1 php5-tokenizer-5.5.14-77.6.1 php5-wddx-5.5.14-77.6.1 php5-xmlreader-5.5.14-77.6.1 php5-xmlrpc-5.5.14-77.6.1 php5-xmlwriter-5.5.14-77.6.1 php5-xsl-5.5.14-77.6.1 php5-zip-5.5.14-77.6.1 php5-zlib-5.5.14-77.6.1 apache2-mod_php5-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-bcmath-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-bz2-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-calendar-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-ctype-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-curl-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-dba-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-devel-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-dom-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-enchant-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-exif-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-fastcgi-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-fileinfo-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-firebird-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-fpm-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-ftp-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-gd-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-gettext-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-gmp-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-iconv-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-imap-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-intl-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-json-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-ldap-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-mbstring-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-mcrypt-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-mssql-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-mysql-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-odbc-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-opcache-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-openssl-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-pcntl-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-pdo-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-pear-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-pgsql-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-phar-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-posix-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-pspell-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-readline-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-shmop-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-snmp-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-soap-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-sockets-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-sqlite-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-suhosin-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-sysvmsg-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-sysvsem-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-sysvshm-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-tidy-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-tokenizer-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-wddx-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-xmlreader-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-xmlrpc-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-xmlwriter-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-xsl-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-zip-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 php5-zlib-5.5.14-77.6.1 as a component of openSUSE Leap 42.2 The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument. CVE-2016-6294 openSUSE Leap 42.2:apache2-mod_php5-5.5.14-77.6.1 openSUSE Leap 42.2:php5-5.5.14-77.6.1 openSUSE Leap 42.2:php5-bcmath-5.5.14-77.6.1 openSUSE Leap 42.2:php5-bz2-5.5.14-77.6.1 openSUSE Leap 42.2:php5-calendar-5.5.14-77.6.1 openSUSE Leap 42.2:php5-ctype-5.5.14-77.6.1 openSUSE Leap 42.2:php5-curl-5.5.14-77.6.1 openSUSE Leap 42.2:php5-dba-5.5.14-77.6.1 openSUSE Leap 42.2:php5-devel-5.5.14-77.6.1 openSUSE Leap 42.2:php5-dom-5.5.14-77.6.1 openSUSE Leap 42.2:php5-enchant-5.5.14-77.6.1 openSUSE Leap 42.2:php5-exif-5.5.14-77.6.1 openSUSE Leap 42.2:php5-fastcgi-5.5.14-77.6.1 openSUSE Leap 42.2:php5-fileinfo-5.5.14-77.6.1 openSUSE Leap 42.2:php5-firebird-5.5.14-77.6.1 openSUSE Leap 42.2:php5-fpm-5.5.14-77.6.1 openSUSE Leap 42.2:php5-ftp-5.5.14-77.6.1 openSUSE Leap 42.2:php5-gd-5.5.14-77.6.1 openSUSE Leap 42.2:php5-gettext-5.5.14-77.6.1 openSUSE Leap 42.2:php5-gmp-5.5.14-77.6.1 openSUSE Leap 42.2:php5-iconv-5.5.14-77.6.1 openSUSE Leap 42.2:php5-imap-5.5.14-77.6.1 openSUSE Leap 42.2:php5-intl-5.5.14-77.6.1 openSUSE Leap 42.2:php5-json-5.5.14-77.6.1 openSUSE Leap 42.2:php5-ldap-5.5.14-77.6.1 openSUSE Leap 42.2:php5-mbstring-5.5.14-77.6.1 openSUSE Leap 42.2:php5-mcrypt-5.5.14-77.6.1 openSUSE Leap 42.2:php5-mssql-5.5.14-77.6.1 openSUSE Leap 42.2:php5-mysql-5.5.14-77.6.1 openSUSE Leap 42.2:php5-odbc-5.5.14-77.6.1 openSUSE Leap 42.2:php5-opcache-5.5.14-77.6.1 openSUSE Leap 42.2:php5-openssl-5.5.14-77.6.1 openSUSE Leap 42.2:php5-pcntl-5.5.14-77.6.1 openSUSE Leap 42.2:php5-pdo-5.5.14-77.6.1 openSUSE Leap 42.2:php5-pear-5.5.14-77.6.1 openSUSE Leap 42.2:php5-pgsql-5.5.14-77.6.1 openSUSE Leap 42.2:php5-phar-5.5.14-77.6.1 openSUSE Leap 42.2:php5-posix-5.5.14-77.6.1 openSUSE Leap 42.2:php5-pspell-5.5.14-77.6.1 openSUSE Leap 42.2:php5-readline-5.5.14-77.6.1 openSUSE Leap 42.2:php5-shmop-5.5.14-77.6.1 openSUSE Leap 42.2:php5-snmp-5.5.14-77.6.1 openSUSE Leap 42.2:php5-soap-5.5.14-77.6.1 openSUSE Leap 42.2:php5-sockets-5.5.14-77.6.1 openSUSE Leap 42.2:php5-sqlite-5.5.14-77.6.1 openSUSE Leap 42.2:php5-suhosin-5.5.14-77.6.1 openSUSE Leap 42.2:php5-sysvmsg-5.5.14-77.6.1 openSUSE Leap 42.2:php5-sysvsem-5.5.14-77.6.1 openSUSE Leap 42.2:php5-sysvshm-5.5.14-77.6.1 openSUSE Leap 42.2:php5-tidy-5.5.14-77.6.1 openSUSE Leap 42.2:php5-tokenizer-5.5.14-77.6.1 openSUSE Leap 42.2:php5-wddx-5.5.14-77.6.1 openSUSE Leap 42.2:php5-xmlreader-5.5.14-77.6.1 openSUSE Leap 42.2:php5-xmlrpc-5.5.14-77.6.1 openSUSE Leap 42.2:php5-xmlwriter-5.5.14-77.6.1 openSUSE Leap 42.2:php5-xsl-5.5.14-77.6.1 openSUSE Leap 42.2:php5-zip-5.5.14-77.6.1 openSUSE Leap 42.2:php5-zlib-5.5.14-77.6.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2017-07/msg00011.html https://www.suse.com/security/cve/CVE-2016-6294.html CVE-2016-6294 https://bugzilla.suse.com/1035111 SUSE Bug 1035111 https://bugzilla.suse.com/1044976 SUSE Bug 1044976 https://bugzilla.suse.com/990636 SUSE Bug 990636 An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in match_at() during regular expression searching. A logical error involving order of validation and access in match_at() could result in an out-of-bounds read from a stack buffer. CVE-2017-9224 openSUSE Leap 42.2:apache2-mod_php5-5.5.14-77.6.1 openSUSE Leap 42.2:php5-5.5.14-77.6.1 openSUSE Leap 42.2:php5-bcmath-5.5.14-77.6.1 openSUSE Leap 42.2:php5-bz2-5.5.14-77.6.1 openSUSE Leap 42.2:php5-calendar-5.5.14-77.6.1 openSUSE Leap 42.2:php5-ctype-5.5.14-77.6.1 openSUSE Leap 42.2:php5-curl-5.5.14-77.6.1 openSUSE Leap 42.2:php5-dba-5.5.14-77.6.1 openSUSE Leap 42.2:php5-devel-5.5.14-77.6.1 openSUSE Leap 42.2:php5-dom-5.5.14-77.6.1 openSUSE Leap 42.2:php5-enchant-5.5.14-77.6.1 openSUSE Leap 42.2:php5-exif-5.5.14-77.6.1 openSUSE Leap 42.2:php5-fastcgi-5.5.14-77.6.1 openSUSE Leap 42.2:php5-fileinfo-5.5.14-77.6.1 openSUSE Leap 42.2:php5-firebird-5.5.14-77.6.1 openSUSE Leap 42.2:php5-fpm-5.5.14-77.6.1 openSUSE Leap 42.2:php5-ftp-5.5.14-77.6.1 openSUSE Leap 42.2:php5-gd-5.5.14-77.6.1 openSUSE Leap 42.2:php5-gettext-5.5.14-77.6.1 openSUSE Leap 42.2:php5-gmp-5.5.14-77.6.1 openSUSE Leap 42.2:php5-iconv-5.5.14-77.6.1 openSUSE Leap 42.2:php5-imap-5.5.14-77.6.1 openSUSE Leap 42.2:php5-intl-5.5.14-77.6.1 openSUSE Leap 42.2:php5-json-5.5.14-77.6.1 openSUSE Leap 42.2:php5-ldap-5.5.14-77.6.1 openSUSE Leap 42.2:php5-mbstring-5.5.14-77.6.1 openSUSE Leap 42.2:php5-mcrypt-5.5.14-77.6.1 openSUSE Leap 42.2:php5-mssql-5.5.14-77.6.1 openSUSE Leap 42.2:php5-mysql-5.5.14-77.6.1 openSUSE Leap 42.2:php5-odbc-5.5.14-77.6.1 openSUSE Leap 42.2:php5-opcache-5.5.14-77.6.1 openSUSE Leap 42.2:php5-openssl-5.5.14-77.6.1 openSUSE Leap 42.2:php5-pcntl-5.5.14-77.6.1 openSUSE Leap 42.2:php5-pdo-5.5.14-77.6.1 openSUSE Leap 42.2:php5-pear-5.5.14-77.6.1 openSUSE Leap 42.2:php5-pgsql-5.5.14-77.6.1 openSUSE Leap 42.2:php5-phar-5.5.14-77.6.1 openSUSE Leap 42.2:php5-posix-5.5.14-77.6.1 openSUSE Leap 42.2:php5-pspell-5.5.14-77.6.1 openSUSE Leap 42.2:php5-readline-5.5.14-77.6.1 openSUSE Leap 42.2:php5-shmop-5.5.14-77.6.1 openSUSE Leap 42.2:php5-snmp-5.5.14-77.6.1 openSUSE Leap 42.2:php5-soap-5.5.14-77.6.1 openSUSE Leap 42.2:php5-sockets-5.5.14-77.6.1 openSUSE Leap 42.2:php5-sqlite-5.5.14-77.6.1 openSUSE Leap 42.2:php5-suhosin-5.5.14-77.6.1 openSUSE Leap 42.2:php5-sysvmsg-5.5.14-77.6.1 openSUSE Leap 42.2:php5-sysvsem-5.5.14-77.6.1 openSUSE Leap 42.2:php5-sysvshm-5.5.14-77.6.1 openSUSE Leap 42.2:php5-tidy-5.5.14-77.6.1 openSUSE Leap 42.2:php5-tokenizer-5.5.14-77.6.1 openSUSE Leap 42.2:php5-wddx-5.5.14-77.6.1 openSUSE Leap 42.2:php5-xmlreader-5.5.14-77.6.1 openSUSE Leap 42.2:php5-xmlrpc-5.5.14-77.6.1 openSUSE Leap 42.2:php5-xmlwriter-5.5.14-77.6.1 openSUSE Leap 42.2:php5-xsl-5.5.14-77.6.1 openSUSE Leap 42.2:php5-zip-5.5.14-77.6.1 openSUSE Leap 42.2:php5-zlib-5.5.14-77.6.1 moderate 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2017-07/msg00011.html https://www.suse.com/security/cve/CVE-2017-9224.html CVE-2017-9224 https://bugzilla.suse.com/1040891 SUSE Bug 1040891 https://bugzilla.suse.com/1044976 SUSE Bug 1044976 An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption. CVE-2017-9226 openSUSE Leap 42.2:apache2-mod_php5-5.5.14-77.6.1 openSUSE Leap 42.2:php5-5.5.14-77.6.1 openSUSE Leap 42.2:php5-bcmath-5.5.14-77.6.1 openSUSE Leap 42.2:php5-bz2-5.5.14-77.6.1 openSUSE Leap 42.2:php5-calendar-5.5.14-77.6.1 openSUSE Leap 42.2:php5-ctype-5.5.14-77.6.1 openSUSE Leap 42.2:php5-curl-5.5.14-77.6.1 openSUSE Leap 42.2:php5-dba-5.5.14-77.6.1 openSUSE Leap 42.2:php5-devel-5.5.14-77.6.1 openSUSE Leap 42.2:php5-dom-5.5.14-77.6.1 openSUSE Leap 42.2:php5-enchant-5.5.14-77.6.1 openSUSE Leap 42.2:php5-exif-5.5.14-77.6.1 openSUSE Leap 42.2:php5-fastcgi-5.5.14-77.6.1 openSUSE Leap 42.2:php5-fileinfo-5.5.14-77.6.1 openSUSE Leap 42.2:php5-firebird-5.5.14-77.6.1 openSUSE Leap 42.2:php5-fpm-5.5.14-77.6.1 openSUSE Leap 42.2:php5-ftp-5.5.14-77.6.1 openSUSE Leap 42.2:php5-gd-5.5.14-77.6.1 openSUSE Leap 42.2:php5-gettext-5.5.14-77.6.1 openSUSE Leap 42.2:php5-gmp-5.5.14-77.6.1 openSUSE Leap 42.2:php5-iconv-5.5.14-77.6.1 openSUSE Leap 42.2:php5-imap-5.5.14-77.6.1 openSUSE Leap 42.2:php5-intl-5.5.14-77.6.1 openSUSE Leap 42.2:php5-json-5.5.14-77.6.1 openSUSE Leap 42.2:php5-ldap-5.5.14-77.6.1 openSUSE Leap 42.2:php5-mbstring-5.5.14-77.6.1 openSUSE Leap 42.2:php5-mcrypt-5.5.14-77.6.1 openSUSE Leap 42.2:php5-mssql-5.5.14-77.6.1 openSUSE Leap 42.2:php5-mysql-5.5.14-77.6.1 openSUSE Leap 42.2:php5-odbc-5.5.14-77.6.1 openSUSE Leap 42.2:php5-opcache-5.5.14-77.6.1 openSUSE Leap 42.2:php5-openssl-5.5.14-77.6.1 openSUSE Leap 42.2:php5-pcntl-5.5.14-77.6.1 openSUSE Leap 42.2:php5-pdo-5.5.14-77.6.1 openSUSE Leap 42.2:php5-pear-5.5.14-77.6.1 openSUSE Leap 42.2:php5-pgsql-5.5.14-77.6.1 openSUSE Leap 42.2:php5-phar-5.5.14-77.6.1 openSUSE Leap 42.2:php5-posix-5.5.14-77.6.1 openSUSE Leap 42.2:php5-pspell-5.5.14-77.6.1 openSUSE Leap 42.2:php5-readline-5.5.14-77.6.1 openSUSE Leap 42.2:php5-shmop-5.5.14-77.6.1 openSUSE Leap 42.2:php5-snmp-5.5.14-77.6.1 openSUSE Leap 42.2:php5-soap-5.5.14-77.6.1 openSUSE Leap 42.2:php5-sockets-5.5.14-77.6.1 openSUSE Leap 42.2:php5-sqlite-5.5.14-77.6.1 openSUSE Leap 42.2:php5-suhosin-5.5.14-77.6.1 openSUSE Leap 42.2:php5-sysvmsg-5.5.14-77.6.1 openSUSE Leap 42.2:php5-sysvsem-5.5.14-77.6.1 openSUSE Leap 42.2:php5-sysvshm-5.5.14-77.6.1 openSUSE Leap 42.2:php5-tidy-5.5.14-77.6.1 openSUSE Leap 42.2:php5-tokenizer-5.5.14-77.6.1 openSUSE Leap 42.2:php5-wddx-5.5.14-77.6.1 openSUSE Leap 42.2:php5-xmlreader-5.5.14-77.6.1 openSUSE Leap 42.2:php5-xmlrpc-5.5.14-77.6.1 openSUSE Leap 42.2:php5-xmlwriter-5.5.14-77.6.1 openSUSE Leap 42.2:php5-xsl-5.5.14-77.6.1 openSUSE Leap 42.2:php5-zip-5.5.14-77.6.1 openSUSE Leap 42.2:php5-zlib-5.5.14-77.6.1 moderate 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2017-07/msg00011.html https://www.suse.com/security/cve/CVE-2017-9226.html CVE-2017-9226 https://bugzilla.suse.com/1040889 SUSE Bug 1040889 https://bugzilla.suse.com/1044976 SUSE Bug 1044976 An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could result in an invalid pointer dereference, as an out-of-bounds read from a stack buffer. CVE-2017-9227 openSUSE Leap 42.2:apache2-mod_php5-5.5.14-77.6.1 openSUSE Leap 42.2:php5-5.5.14-77.6.1 openSUSE Leap 42.2:php5-bcmath-5.5.14-77.6.1 openSUSE Leap 42.2:php5-bz2-5.5.14-77.6.1 openSUSE Leap 42.2:php5-calendar-5.5.14-77.6.1 openSUSE Leap 42.2:php5-ctype-5.5.14-77.6.1 openSUSE Leap 42.2:php5-curl-5.5.14-77.6.1 openSUSE Leap 42.2:php5-dba-5.5.14-77.6.1 openSUSE Leap 42.2:php5-devel-5.5.14-77.6.1 openSUSE Leap 42.2:php5-dom-5.5.14-77.6.1 openSUSE Leap 42.2:php5-enchant-5.5.14-77.6.1 openSUSE Leap 42.2:php5-exif-5.5.14-77.6.1 openSUSE Leap 42.2:php5-fastcgi-5.5.14-77.6.1 openSUSE Leap 42.2:php5-fileinfo-5.5.14-77.6.1 openSUSE Leap 42.2:php5-firebird-5.5.14-77.6.1 openSUSE Leap 42.2:php5-fpm-5.5.14-77.6.1 openSUSE Leap 42.2:php5-ftp-5.5.14-77.6.1 openSUSE Leap 42.2:php5-gd-5.5.14-77.6.1 openSUSE Leap 42.2:php5-gettext-5.5.14-77.6.1 openSUSE Leap 42.2:php5-gmp-5.5.14-77.6.1 openSUSE Leap 42.2:php5-iconv-5.5.14-77.6.1 openSUSE Leap 42.2:php5-imap-5.5.14-77.6.1 openSUSE Leap 42.2:php5-intl-5.5.14-77.6.1 openSUSE Leap 42.2:php5-json-5.5.14-77.6.1 openSUSE Leap 42.2:php5-ldap-5.5.14-77.6.1 openSUSE Leap 42.2:php5-mbstring-5.5.14-77.6.1 openSUSE Leap 42.2:php5-mcrypt-5.5.14-77.6.1 openSUSE Leap 42.2:php5-mssql-5.5.14-77.6.1 openSUSE Leap 42.2:php5-mysql-5.5.14-77.6.1 openSUSE Leap 42.2:php5-odbc-5.5.14-77.6.1 openSUSE Leap 42.2:php5-opcache-5.5.14-77.6.1 openSUSE Leap 42.2:php5-openssl-5.5.14-77.6.1 openSUSE Leap 42.2:php5-pcntl-5.5.14-77.6.1 openSUSE Leap 42.2:php5-pdo-5.5.14-77.6.1 openSUSE Leap 42.2:php5-pear-5.5.14-77.6.1 openSUSE Leap 42.2:php5-pgsql-5.5.14-77.6.1 openSUSE Leap 42.2:php5-phar-5.5.14-77.6.1 openSUSE Leap 42.2:php5-posix-5.5.14-77.6.1 openSUSE Leap 42.2:php5-pspell-5.5.14-77.6.1 openSUSE Leap 42.2:php5-readline-5.5.14-77.6.1 openSUSE Leap 42.2:php5-shmop-5.5.14-77.6.1 openSUSE Leap 42.2:php5-snmp-5.5.14-77.6.1 openSUSE Leap 42.2:php5-soap-5.5.14-77.6.1 openSUSE Leap 42.2:php5-sockets-5.5.14-77.6.1 openSUSE Leap 42.2:php5-sqlite-5.5.14-77.6.1 openSUSE Leap 42.2:php5-suhosin-5.5.14-77.6.1 openSUSE Leap 42.2:php5-sysvmsg-5.5.14-77.6.1 openSUSE Leap 42.2:php5-sysvsem-5.5.14-77.6.1 openSUSE Leap 42.2:php5-sysvshm-5.5.14-77.6.1 openSUSE Leap 42.2:php5-tidy-5.5.14-77.6.1 openSUSE Leap 42.2:php5-tokenizer-5.5.14-77.6.1 openSUSE Leap 42.2:php5-wddx-5.5.14-77.6.1 openSUSE Leap 42.2:php5-xmlreader-5.5.14-77.6.1 openSUSE Leap 42.2:php5-xmlrpc-5.5.14-77.6.1 openSUSE Leap 42.2:php5-xmlwriter-5.5.14-77.6.1 openSUSE Leap 42.2:php5-xsl-5.5.14-77.6.1 openSUSE Leap 42.2:php5-zip-5.5.14-77.6.1 openSUSE Leap 42.2:php5-zlib-5.5.14-77.6.1 moderate 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2017-07/msg00011.html https://www.suse.com/security/cve/CVE-2017-9227.html CVE-2017-9227 https://bugzilla.suse.com/1040883 SUSE Bug 1040883 https://bugzilla.suse.com/1044976 SUSE Bug 1044976