Security update for php5 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:2894-1 Final 1 1 2020-10-12T15:07:54Z current 2020-10-12T15:07:54Z 2020-10-12T15:07:54Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for php5 This update for php5 fixes the following issues: - CVE-2020-7070: Fixed an issue where percent-encoded cookies could have been used to overwrite existing prefixed cookie names (bsc#1177352). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-2894,SUSE-SLE-Module-Web-Scripting-12-2020-2894 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20202894-1/ Link for SUSE-SU-2020:2894-1 https://lists.suse.com/pipermail/sle-security-updates/2020-October/007538.html E-Mail link for SUSE-SU-2020:2894-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1177352 SUSE Bug 1177352 https://www.suse.com/security/cve/CVE-2020-7070/ SUSE CVE CVE-2020-7070 page SUSE Linux Enterprise Module for Web and Scripting 12 apache2-mod_php5-5.5.14-109.82.1 php5-5.5.14-109.82.1 php5-bcmath-5.5.14-109.82.1 php5-bz2-5.5.14-109.82.1 php5-calendar-5.5.14-109.82.1 php5-ctype-5.5.14-109.82.1 php5-curl-5.5.14-109.82.1 php5-dba-5.5.14-109.82.1 php5-devel-5.5.14-109.82.1 php5-dom-5.5.14-109.82.1 php5-enchant-5.5.14-109.82.1 php5-exif-5.5.14-109.82.1 php5-fastcgi-5.5.14-109.82.1 php5-fileinfo-5.5.14-109.82.1 php5-firebird-5.5.14-109.82.1 php5-fpm-5.5.14-109.82.1 php5-ftp-5.5.14-109.82.1 php5-gd-5.5.14-109.82.1 php5-gettext-5.5.14-109.82.1 php5-gmp-5.5.14-109.82.1 php5-iconv-5.5.14-109.82.1 php5-imap-5.5.14-109.82.1 php5-intl-5.5.14-109.82.1 php5-json-5.5.14-109.82.1 php5-ldap-5.5.14-109.82.1 php5-mbstring-5.5.14-109.82.1 php5-mcrypt-5.5.14-109.82.1 php5-mssql-5.5.14-109.82.1 php5-mysql-5.5.14-109.82.1 php5-odbc-5.5.14-109.82.1 php5-opcache-5.5.14-109.82.1 php5-openssl-5.5.14-109.82.1 php5-pcntl-5.5.14-109.82.1 php5-pdo-5.5.14-109.82.1 php5-pear-5.5.14-109.82.1 php5-pgsql-5.5.14-109.82.1 php5-phar-5.5.14-109.82.1 php5-posix-5.5.14-109.82.1 php5-pspell-5.5.14-109.82.1 php5-readline-5.5.14-109.82.1 php5-shmop-5.5.14-109.82.1 php5-snmp-5.5.14-109.82.1 php5-soap-5.5.14-109.82.1 php5-sockets-5.5.14-109.82.1 php5-sqlite-5.5.14-109.82.1 php5-suhosin-5.5.14-109.82.1 php5-sysvmsg-5.5.14-109.82.1 php5-sysvsem-5.5.14-109.82.1 php5-sysvshm-5.5.14-109.82.1 php5-tidy-5.5.14-109.82.1 php5-tokenizer-5.5.14-109.82.1 php5-wddx-5.5.14-109.82.1 php5-xmlreader-5.5.14-109.82.1 php5-xmlrpc-5.5.14-109.82.1 php5-xmlwriter-5.5.14-109.82.1 php5-xsl-5.5.14-109.82.1 php5-zip-5.5.14-109.82.1 php5-zlib-5.5.14-109.82.1 apache2-mod_php5-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-bcmath-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-bz2-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-calendar-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-ctype-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-curl-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-dba-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-dom-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-enchant-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-exif-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-fastcgi-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-fileinfo-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-fpm-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-ftp-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-gd-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-gettext-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-gmp-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-iconv-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-imap-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-intl-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-json-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-ldap-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-mbstring-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-mcrypt-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-mysql-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-odbc-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-opcache-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-openssl-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-pcntl-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-pdo-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-pear-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-pgsql-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-phar-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-posix-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-pspell-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-shmop-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-snmp-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-soap-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-sockets-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-sqlite-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-suhosin-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-sysvmsg-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-sysvsem-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-sysvshm-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-tokenizer-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-wddx-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-xmlreader-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-xmlrpc-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-xmlwriter-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-xsl-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-zip-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 php5-zlib-5.5.14-109.82.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information. CVE-2020-7070 SUSE Linux Enterprise Module for Web and Scripting 12:apache2-mod_php5-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-bcmath-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-bz2-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-calendar-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-ctype-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-curl-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-dba-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-dom-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-enchant-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-exif-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-fastcgi-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-fileinfo-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-fpm-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-ftp-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-gd-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-gettext-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-gmp-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-iconv-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-imap-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-intl-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-json-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-ldap-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-mbstring-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-mcrypt-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-mysql-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-odbc-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-opcache-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-openssl-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-pcntl-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-pdo-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-pear-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-pgsql-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-phar-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-posix-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-pspell-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-shmop-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-snmp-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-soap-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-sockets-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-sqlite-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-suhosin-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-sysvmsg-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-sysvsem-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-sysvshm-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-tokenizer-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-wddx-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-xmlreader-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-xmlrpc-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-xmlwriter-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-xsl-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-zip-5.5.14-109.82.1 SUSE Linux Enterprise Module for Web and Scripting 12:php5-zlib-5.5.14-109.82.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20202894-1/ https://www.suse.com/security/cve/CVE-2020-7070.html CVE-2020-7070 https://bugzilla.suse.com/1177352 SUSE Bug 1177352