File _patchinfo of Package patchinfo.10553

Overview Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo.10553

<patchinfo incident="10553">
  <issue tracker="bnc" id="1128892">VUL-1: CVE-2019-9637: php5,php72,php7,php53: php7.0 -- security update</issue>
  <issue tracker="bnc" id="1128886">VUL-1: CVE-2019-9675: php5,php72,php7,php53: php7.0 -- security update</issue>
  <issue tracker="bnc" id="1128889">VUL-1: CVE-2019-9638: php5,php72,php7,php53: php7.0 -- security update</issue>
  <issue tracker="bnc" id="1128887">VUL-1: CVE-2019-9639: php5,php72,php7,php53: php7.0 -- security update</issue>
  <issue tracker="bnc" id="1128883">VUL-1: CVE-2019-9640: php5,php72,php7,php53: php7.0 -- security update</issue>	
  <issue tracker="bnc" id="1129032">php72 package still contains unneeded README.default_socket_timeout</issue>
  <issue tracker="bnc" id="1126711">VUL-1: CVE-2019-9020: php5,php7,php53: Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap ou</issue>
  <issue tracker="bnc" id="1126713">VUL-1: CVE-2019-9021: php5,php7,php53: heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an</issue>
  <issue tracker="bnc" id="1127122">VUL-1: CVE-2018-20783: php5,php7,php53: buffer over-read in PHAR reading functions</issue>
  <issue tracker="bnc" id="1126823">VUL-1: CVE-2019-9023: php5,php7,php53: a number of heap-based buffer over-read instances are present in mbstring regular expression functions</issue>
  <issue tracker="bnc" id="1126821">VUL-0: CVE-2019-9024: php5,php7,php53: xmlrpc_decode() can allow a hostile XMLRPC server to read memory outside of allocated areas</issue>
  <issue tracker="bnc" id="1128722">VUL-1: CVE-2019-9641: php5,php7,php53: Uninitialized read in exif_process_IFD_in_TIFF</issue>
  <issue tracker="cve" id="2019-9637"/>
  <issue tracker="cve" id="2019-9675"/>
  <issue tracker="cve" id="2019-9638"/>
  <issue tracker="cve" id="2019-9639"/>
  <issue tracker="cve" id="2019-9640"/>
  <issue tracker="cve" id="2018-20783"/>
  <issue tracker="cve" id="2019-9024"/>
  <issue tracker="cve" id="2019-9021"/>
  <issue tracker="cve" id="2019-9020"/>
  <issue tracker="cve" id="2019-9023"/>
  <issue tracker="cve" id="2019-9641"/>
  <category>security</category>
  <rating>moderate</rating>
  <packager>pgajdos</packager>
  <description>This update for php7 fixes the following issues:
	  
Security issues fixed:

- CVE-2019-9637: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128892).
- CVE-2019-9675: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128886).
- CVE-2019-9638: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension ((bsc#1128889).
- CVE-2019-9639: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128887).
- CVE-2019-9640: Fixed improper implementation of rename function and multiple invalid memory access in EXIF extension (bsc#1128883).
- CVE-2019-9024: Fixed a vulnerability in xmlrpc_decode function which could allow to a hostile XMLRPC server
  to cause memory read outside the allocated areas (bsc#1126821).
- CVE-2019-9020: Fixed a heap out of bounds in xmlrpc_decode function (bsc#1126711).
- CVE-2018-20783: Fixed a buffer over-read in PHAR reading functions which could allow an attacker to read 
  allocated and unallocated memory when parsing a phar file (bsc#1127122).
- CVE-2019-9021: Fixed a heap buffer-based buffer over-read in PHAR reading functions which could allow an 
  attacker to read allocated and unallocated memory when parsing a phar file (bsc#1126713).
- CVE-2019-9023: Fixed multiple heap-based buffer over-read instances in mbstring regular expression functions (bsc#1126823).
- CVE-2019-9641: Fixed multiple invalid memory access in EXIF extension and improved insecure implementation 
  of rename function (bsc#1128722).

Other issue addressed:

- Deleted README.default_socket_timeout which is not needed anymore (bsc#1129032).
</description>
  <summary>Security update for php7</summary>
</patchinfo>

Places

File _patchinfo of Package patchinfo.10553

Places