Security update for php7 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:1545-1 Final 1 1 2020-06-05T10:47:10Z current 2020-06-05T10:47:10Z 2020-06-05T10:47:10Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for php7 This update for php7 fixes the following issues: Security issue fixed: - CVE-2019-11048: Improved the handling of overly long filenames or field names in HTTP file uploads (bsc#1171999). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-1545,SUSE-SLE-Module-Web-Scripting-12-2020-1545,SUSE-SLE-SDK-12-SP4-2020-1545,SUSE-SLE-SDK-12-SP5-2020-1545 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20201545-1/ Link for SUSE-SU-2020:1545-1 https://lists.suse.com/pipermail/sle-security-updates/2020-June/006889.html E-Mail link for SUSE-SU-2020:1545-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1171999 SUSE Bug 1171999 https://www.suse.com/security/cve/CVE-2019-11048/ SUSE CVE CVE-2019-11048 page SUSE Linux Enterprise Module for Web and Scripting 12 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP5 apache2-mod_php7-7.0.7-50.94.1 php7-7.0.7-50.94.1 php7-bcmath-7.0.7-50.94.1 php7-bz2-7.0.7-50.94.1 php7-calendar-7.0.7-50.94.1 php7-ctype-7.0.7-50.94.1 php7-curl-7.0.7-50.94.1 php7-dba-7.0.7-50.94.1 php7-devel-7.0.7-50.94.1 php7-dom-7.0.7-50.94.1 php7-enchant-7.0.7-50.94.1 php7-exif-7.0.7-50.94.1 php7-fastcgi-7.0.7-50.94.1 php7-fileinfo-7.0.7-50.94.1 php7-firebird-7.0.7-50.94.1 php7-fpm-7.0.7-50.94.1 php7-ftp-7.0.7-50.94.1 php7-gd-7.0.7-50.94.1 php7-gettext-7.0.7-50.94.1 php7-gmp-7.0.7-50.94.1 php7-iconv-7.0.7-50.94.1 php7-imap-7.0.7-50.94.1 php7-intl-7.0.7-50.94.1 php7-json-7.0.7-50.94.1 php7-ldap-7.0.7-50.94.1 php7-mbstring-7.0.7-50.94.1 php7-mcrypt-7.0.7-50.94.1 php7-mysql-7.0.7-50.94.1 php7-odbc-7.0.7-50.94.1 php7-opcache-7.0.7-50.94.1 php7-openssl-7.0.7-50.94.1 php7-pcntl-7.0.7-50.94.1 php7-pdo-7.0.7-50.94.1 php7-pear-7.0.7-50.94.1 php7-pear-Archive_Tar-7.0.7-50.94.1 php7-pgsql-7.0.7-50.94.1 php7-phar-7.0.7-50.94.1 php7-posix-7.0.7-50.94.1 php7-pspell-7.0.7-50.94.1 php7-readline-7.0.7-50.94.1 php7-shmop-7.0.7-50.94.1 php7-snmp-7.0.7-50.94.1 php7-soap-7.0.7-50.94.1 php7-sockets-7.0.7-50.94.1 php7-sqlite-7.0.7-50.94.1 php7-sysvmsg-7.0.7-50.94.1 php7-sysvsem-7.0.7-50.94.1 php7-sysvshm-7.0.7-50.94.1 php7-testresults-7.0.7-50.94.1 php7-tidy-7.0.7-50.94.1 php7-tokenizer-7.0.7-50.94.1 php7-wddx-7.0.7-50.94.1 php7-xmlreader-7.0.7-50.94.1 php7-xmlrpc-7.0.7-50.94.1 php7-xmlwriter-7.0.7-50.94.1 php7-xsl-7.0.7-50.94.1 php7-zip-7.0.7-50.94.1 php7-zlib-7.0.7-50.94.1 apache2-mod_php7-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-bcmath-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-bz2-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-calendar-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-ctype-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-curl-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-dba-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-dom-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-enchant-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-exif-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-fastcgi-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-fileinfo-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-fpm-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-ftp-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-gd-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-gettext-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-gmp-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-iconv-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-imap-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-intl-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-json-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-ldap-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-mbstring-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-mcrypt-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-mysql-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-odbc-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-opcache-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-openssl-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pcntl-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pdo-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pear-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pear-Archive_Tar-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pgsql-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-phar-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-posix-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-pspell-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-shmop-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-snmp-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-soap-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-sockets-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-sqlite-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-sysvmsg-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-sysvsem-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-sysvshm-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-tokenizer-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-wddx-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-xmlreader-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-xmlrpc-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-xmlwriter-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-xsl-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-zip-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-zlib-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php7-devel-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 php7-devel-7.0.7-50.94.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleaning up temporary files created by upload request. This potentially could lead to accumulation of uncleaned temporary files exhausting the disk space on the target server. CVE-2019-11048 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php7-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bcmath-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-bz2-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-calendar-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ctype-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-curl-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dba-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-dom-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-enchant-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-exif-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fastcgi-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fileinfo-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-fpm-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ftp-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gd-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gettext-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-gmp-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-iconv-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-imap-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-intl-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-json-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-ldap-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mbstring-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mcrypt-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-mysql-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-odbc-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-opcache-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-openssl-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pcntl-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pdo-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pear-Archive_Tar-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pgsql-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-phar-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-posix-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-pspell-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-shmop-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-snmp-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-soap-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sockets-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sqlite-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvmsg-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvsem-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-sysvshm-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-tokenizer-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-wddx-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlreader-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlrpc-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xmlwriter-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-xsl-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zip-7.0.7-50.94.1 SUSE Linux Enterprise Module for Web and Scripting 12:php7-zlib-7.0.7-50.94.1 SUSE Linux Enterprise Software Development Kit 12 SP4:php7-devel-7.0.7-50.94.1 SUSE Linux Enterprise Software Development Kit 12 SP5:php7-devel-7.0.7-50.94.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201545-1/ https://www.suse.com/security/cve/CVE-2019-11048.html CVE-2019-11048 https://bugzilla.suse.com/1171999 SUSE Bug 1171999