Security update for php7 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:1725-1 Final 1 1 2019-07-02T14:50:26Z current 2019-07-02T14:50:26Z 2019-07-02T14:50:26Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for php7 This update for php7 fixes the following issues: Security issues fixed: - CVE-2019-11039: Fixed a heap-buffer-overflow on php_jpg_get16 (bsc#1138173). - CVE-2019-11040: Fixed an out-of-bounds read due to an integer overflow in iconv.c:_php_iconv_mime_decode() (bsc#1138172). Other issue addressed: - Enable php7 testsuite (bsc#1119396 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-1725,SUSE-SLE-Module-Web-Scripting-12-2019-1725,SUSE-SLE-SDK-12-SP3-2019-1725,SUSE-SLE-SDK-12-SP4-2019-1725 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20191725-1/ Link for SUSE-SU-2019:1725-1 https://lists.suse.com/pipermail/sle-security-updates/2019-July/005648.html E-Mail link for SUSE-SU-2019:1725-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1119396 SUSE Bug 1119396 https://bugzilla.suse.com/1138172 SUSE Bug 1138172 https://bugzilla.suse.com/1138173 SUSE Bug 1138173 https://www.suse.com/security/cve/CVE-2019-11039/ SUSE CVE CVE-2019-11039 page https://www.suse.com/security/cve/CVE-2019-11040/ SUSE CVE CVE-2019-11040 page SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP4 apache2-mod_php7-7.0.7-50.80.2 php7-7.0.7-50.80.2 php7-bcmath-7.0.7-50.80.2 php7-bz2-7.0.7-50.80.2 php7-calendar-7.0.7-50.80.2 php7-ctype-7.0.7-50.80.2 php7-curl-7.0.7-50.80.2 php7-dba-7.0.7-50.80.2 php7-devel-7.0.7-50.80.2 php7-dom-7.0.7-50.80.2 php7-enchant-7.0.7-50.80.2 php7-exif-7.0.7-50.80.2 php7-fastcgi-7.0.7-50.80.2 php7-fileinfo-7.0.7-50.80.2 php7-firebird-7.0.7-50.80.2 php7-fpm-7.0.7-50.80.2 php7-ftp-7.0.7-50.80.2 php7-gd-7.0.7-50.80.2 php7-gettext-7.0.7-50.80.2 php7-gmp-7.0.7-50.80.2 php7-iconv-7.0.7-50.80.2 php7-imap-7.0.7-50.80.2 php7-intl-7.0.7-50.80.2 php7-json-7.0.7-50.80.2 php7-ldap-7.0.7-50.80.2 php7-mbstring-7.0.7-50.80.2 php7-mcrypt-7.0.7-50.80.2 php7-mysql-7.0.7-50.80.2 php7-odbc-7.0.7-50.80.2 php7-opcache-7.0.7-50.80.2 php7-openssl-7.0.7-50.80.2 php7-pcntl-7.0.7-50.80.2 php7-pdo-7.0.7-50.80.2 php7-pear-7.0.7-50.80.2 php7-pear-Archive_Tar-7.0.7-50.80.2 php7-pgsql-7.0.7-50.80.2 php7-phar-7.0.7-50.80.2 php7-posix-7.0.7-50.80.2 php7-pspell-7.0.7-50.80.2 php7-readline-7.0.7-50.80.2 php7-shmop-7.0.7-50.80.2 php7-snmp-7.0.7-50.80.2 php7-soap-7.0.7-50.80.2 php7-sockets-7.0.7-50.80.2 php7-sqlite-7.0.7-50.80.2 php7-sysvmsg-7.0.7-50.80.2 php7-sysvsem-7.0.7-50.80.2 php7-sysvshm-7.0.7-50.80.2 php7-testresults-7.0.7-50.80.2 php7-tidy-7.0.7-50.80.2 php7-tokenizer-7.0.7-50.80.2 php7-wddx-7.0.7-50.80.2 php7-xmlreader-7.0.7-50.80.2 php7-xmlrpc-7.0.7-50.80.2 php7-xmlwriter-7.0.7-50.80.2 php7-xsl-7.0.7-50.80.2 php7-zip-7.0.7-50.80.2 php7-zlib-7.0.7-50.80.2 apache2-mod_php7-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-bcmath-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-bz2-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-calendar-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-ctype-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-curl-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-dba-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-dom-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-enchant-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-exif-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-fastcgi-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-fileinfo-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-fpm-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-ftp-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-gd-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-gettext-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-gmp-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-iconv-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-imap-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-intl-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-json-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-ldap-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-mbstring-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-mcrypt-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-mysql-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-odbc-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-opcache-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-openssl-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pcntl-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pdo-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pear-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pear-Archive_Tar-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pgsql-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-phar-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-posix-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pspell-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-shmop-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-snmp-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-soap-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-sockets-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-sqlite-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-sysvmsg-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-sysvsem-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-sysvshm-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-tokenizer-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-wddx-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-xmlreader-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-xmlrpc-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-xmlwriter-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-xsl-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-zip-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-zlib-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-devel-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 php7-devel-7.0.7-50.80.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash. CVE-2019-11039 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php7-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bcmath-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bz2-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-calendar-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ctype-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-curl-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dba-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dom-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-enchant-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-exif-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fastcgi-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fileinfo-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fpm-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ftp-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gd-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gettext-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gmp-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-iconv-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-imap-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-intl-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-json-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ldap-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mbstring-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mcrypt-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mysql-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-odbc-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-opcache-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-openssl-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pcntl-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pdo-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-Archive_Tar-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pgsql-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-phar-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-posix-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pspell-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-shmop-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-snmp-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-soap-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sockets-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sqlite-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvmsg-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvsem-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvshm-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-tokenizer-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-wddx-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlreader-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlrpc-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlwriter-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xsl-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zip-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zlib-7.0.7-50.80.2 SUSE Linux Enterprise Software Development Kit 12 SP3:php7-devel-7.0.7-50.80.2 SUSE Linux Enterprise Software Development Kit 12 SP4:php7-devel-7.0.7-50.80.2 low 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191725-1/ https://www.suse.com/security/cve/CVE-2019-11039.html CVE-2019-11039 https://bugzilla.suse.com/1138173 SUSE Bug 1138173 When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash. CVE-2019-11040 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php7-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bcmath-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bz2-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-calendar-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ctype-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-curl-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dba-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dom-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-enchant-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-exif-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fastcgi-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fileinfo-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fpm-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ftp-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gd-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gettext-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gmp-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-iconv-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-imap-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-intl-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-json-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ldap-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mbstring-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mcrypt-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mysql-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-odbc-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-opcache-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-openssl-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pcntl-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pdo-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-Archive_Tar-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pgsql-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-phar-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-posix-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pspell-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-shmop-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-snmp-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-soap-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sockets-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sqlite-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvmsg-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvsem-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvshm-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-tokenizer-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-wddx-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlreader-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlrpc-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlwriter-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xsl-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zip-7.0.7-50.80.2 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zlib-7.0.7-50.80.2 SUSE Linux Enterprise Software Development Kit 12 SP3:php7-devel-7.0.7-50.80.2 SUSE Linux Enterprise Software Development Kit 12 SP4:php7-devel-7.0.7-50.80.2 moderate 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191725-1/ https://www.suse.com/security/cve/CVE-2019-11040.html CVE-2019-11040 https://bugzilla.suse.com/1138172 SUSE Bug 1138172