Security update for php7 SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2019:2271-1 Final 1 1 2019-10-06T16:19:36Z current 2019-10-06T16:19:36Z 2019-10-06T16:19:36Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for php7 This update for php7 fixes the following issues: Security issues fixed: - CVE-2019-11041: Fixed heap buffer over-read in exif_scan_thumbnail() (bsc#1146360). - CVE-2019-11042: Fixed heap buffer over-read in exif_process_user_comment() (bsc#1145095). Non-security issue fixed: - Drop -n from php invocation from pecl (bsc#1151793). This update was imported from the SUSE:SLE-15:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2019-2271 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5WYNH73HBSVTBMZTEQ5GTE7UV7XMOL6A/#5WYNH73HBSVTBMZTEQ5GTE7UV7XMOL6A E-Mail link for openSUSE-SU-2019:2271-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1145095 SUSE Bug 1145095 https://bugzilla.suse.com/1146360 SUSE Bug 1146360 https://bugzilla.suse.com/1151793 SUSE Bug 1151793 https://www.suse.com/security/cve/CVE-2019-11041/ SUSE CVE CVE-2019-11041 page https://www.suse.com/security/cve/CVE-2019-11042/ SUSE CVE CVE-2019-11042 page openSUSE Leap 15.0 apache2-mod_php7-7.2.5-lp150.2.25.1 php7-7.2.5-lp150.2.25.1 php7-bcmath-7.2.5-lp150.2.25.1 php7-bz2-7.2.5-lp150.2.25.1 php7-calendar-7.2.5-lp150.2.25.1 php7-ctype-7.2.5-lp150.2.25.1 php7-curl-7.2.5-lp150.2.25.1 php7-dba-7.2.5-lp150.2.25.1 php7-devel-7.2.5-lp150.2.25.1 php7-dom-7.2.5-lp150.2.25.1 php7-embed-7.2.5-lp150.2.25.1 php7-enchant-7.2.5-lp150.2.25.1 php7-exif-7.2.5-lp150.2.25.1 php7-fastcgi-7.2.5-lp150.2.25.1 php7-fileinfo-7.2.5-lp150.2.25.1 php7-firebird-7.2.5-lp150.2.25.1 php7-fpm-7.2.5-lp150.2.25.1 php7-ftp-7.2.5-lp150.2.25.1 php7-gd-7.2.5-lp150.2.25.1 php7-gettext-7.2.5-lp150.2.25.1 php7-gmp-7.2.5-lp150.2.25.1 php7-iconv-7.2.5-lp150.2.25.1 php7-intl-7.2.5-lp150.2.25.1 php7-json-7.2.5-lp150.2.25.1 php7-ldap-7.2.5-lp150.2.25.1 php7-mbstring-7.2.5-lp150.2.25.1 php7-mysql-7.2.5-lp150.2.25.1 php7-odbc-7.2.5-lp150.2.25.1 php7-opcache-7.2.5-lp150.2.25.1 php7-openssl-7.2.5-lp150.2.25.1 php7-pcntl-7.2.5-lp150.2.25.1 php7-pdo-7.2.5-lp150.2.25.1 php7-pear-7.2.5-lp150.2.25.1 php7-pear-Archive_Tar-7.2.5-lp150.2.25.1 php7-pgsql-7.2.5-lp150.2.25.1 php7-phar-7.2.5-lp150.2.25.1 php7-posix-7.2.5-lp150.2.25.1 php7-readline-7.2.5-lp150.2.25.1 php7-shmop-7.2.5-lp150.2.25.1 php7-snmp-7.2.5-lp150.2.25.1 php7-soap-7.2.5-lp150.2.25.1 php7-sockets-7.2.5-lp150.2.25.1 php7-sodium-7.2.5-lp150.2.25.1 php7-sqlite-7.2.5-lp150.2.25.1 php7-sysvmsg-7.2.5-lp150.2.25.1 php7-sysvsem-7.2.5-lp150.2.25.1 php7-sysvshm-7.2.5-lp150.2.25.1 php7-tidy-7.2.5-lp150.2.25.1 php7-tokenizer-7.2.5-lp150.2.25.1 php7-wddx-7.2.5-lp150.2.25.1 php7-xmlreader-7.2.5-lp150.2.25.1 php7-xmlrpc-7.2.5-lp150.2.25.1 php7-xmlwriter-7.2.5-lp150.2.25.1 php7-xsl-7.2.5-lp150.2.25.1 php7-zip-7.2.5-lp150.2.25.1 php7-zlib-7.2.5-lp150.2.25.1 apache2-mod_php7-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-bcmath-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-bz2-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-calendar-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-ctype-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-curl-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-dba-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-devel-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-dom-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-embed-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-enchant-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-exif-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-fastcgi-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-fileinfo-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-firebird-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-fpm-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-ftp-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-gd-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-gettext-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-gmp-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-iconv-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-intl-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-json-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-ldap-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-mbstring-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-mysql-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-odbc-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-opcache-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-openssl-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-pcntl-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-pdo-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-pear-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-pear-Archive_Tar-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-pgsql-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-phar-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-posix-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-readline-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-shmop-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-snmp-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-soap-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-sockets-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-sodium-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-sqlite-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-sysvmsg-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-sysvsem-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-sysvshm-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-tidy-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-tokenizer-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-wddx-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-xmlreader-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-xmlrpc-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-xmlwriter-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-xsl-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-zip-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 php7-zlib-7.2.5-lp150.2.25.1 as a component of openSUSE Leap 15.0 When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash. CVE-2019-11041 openSUSE Leap 15.0:apache2-mod_php7-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-bcmath-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-bz2-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-calendar-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-ctype-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-curl-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-dba-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-devel-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-dom-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-embed-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-enchant-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-exif-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-fastcgi-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-fileinfo-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-firebird-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-fpm-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-ftp-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-gd-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-gettext-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-gmp-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-iconv-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-intl-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-json-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-ldap-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-mbstring-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-mysql-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-odbc-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-opcache-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-openssl-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-pcntl-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-pdo-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-pear-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-pear-Archive_Tar-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-pgsql-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-phar-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-posix-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-readline-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-shmop-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-snmp-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-soap-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-sockets-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-sodium-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-sqlite-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-sysvmsg-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-sysvsem-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-sysvshm-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-tidy-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-tokenizer-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-wddx-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-xmlreader-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-xmlrpc-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-xmlwriter-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-xsl-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-zip-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-zlib-7.2.5-lp150.2.25.1 important 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5WYNH73HBSVTBMZTEQ5GTE7UV7XMOL6A/#5WYNH73HBSVTBMZTEQ5GTE7UV7XMOL6A https://www.suse.com/security/cve/CVE-2019-11041.html CVE-2019-11041 https://bugzilla.suse.com/1146360 SUSE Bug 1146360 When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash. CVE-2019-11042 openSUSE Leap 15.0:apache2-mod_php7-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-bcmath-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-bz2-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-calendar-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-ctype-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-curl-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-dba-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-devel-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-dom-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-embed-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-enchant-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-exif-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-fastcgi-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-fileinfo-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-firebird-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-fpm-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-ftp-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-gd-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-gettext-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-gmp-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-iconv-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-intl-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-json-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-ldap-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-mbstring-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-mysql-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-odbc-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-opcache-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-openssl-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-pcntl-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-pdo-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-pear-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-pear-Archive_Tar-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-pgsql-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-phar-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-posix-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-readline-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-shmop-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-snmp-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-soap-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-sockets-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-sodium-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-sqlite-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-sysvmsg-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-sysvsem-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-sysvshm-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-tidy-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-tokenizer-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-wddx-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-xmlreader-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-xmlrpc-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-xmlwriter-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-xsl-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-zip-7.2.5-lp150.2.25.1 openSUSE Leap 15.0:php7-zlib-7.2.5-lp150.2.25.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5WYNH73HBSVTBMZTEQ5GTE7UV7XMOL6A/#5WYNH73HBSVTBMZTEQ5GTE7UV7XMOL6A https://www.suse.com/security/cve/CVE-2019-11042.html CVE-2019-11042 https://bugzilla.suse.com/1145095 SUSE Bug 1145095