Security update for php5
This update for php5 fixes the following issues:
- CVE-2015-7803: Specially crafted .phar files with a crafted TAR archive entry allowed remote attackers to cause a Denial of Service (DoS) [bsc#949961]
- CVE-2015-7804: Specially crafted .phar files with a crafted ZIP archive entry referencing a file "/" allowed remote attackers to cause a Denial of Service (DoS) or potentially leak unspecified memory content [bsc#949961]
- CVE-2016-1903: Specially crafted image files could allowed remote attackers read unspecified memory when rotating images [bsc#962057]
-
Submitted by
Petr Gajdos (pgajdos)
Fixed bugs
bnc#962057
VUL-0: CVE-2016-1903: php5: Memory Read via gdImageRotateInterpolated Array Index Out of Bounds
bnc#949961
VUL-1: CVE-2015-7803: php5,php53: Null pointer dereference in phar_get_fp_offset()
bnc#949962
VUL-1: CVE-2015-7804: php5,php53: Uninitialized pointer in phar_make_dirstream when zip entry filename is "/"
