Security update for php7 SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:0318-1 Final 1 1 2018-01-31T18:54:37Z current 2018-01-31T18:54:37Z 2018-01-31T18:54:37Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for php7 This update for php7 fixes several issues. These security issues were fixed: - CVE-2018-5712: Prevent reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file that allowed for information disclosure (bsc#1076220). - CVE-2018-5711: Prevent integer signedness error that could have lead to an infinite loop via a crafted GIF file allowing for DoS (bsc#1076391) This update was imported from the SUSE:SLE-12:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2018-01/msg00116.html E-Mail link for openSUSE-SU-2018:0318-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.3 apache2-mod_php7-7.0.7-28.1 php7-7.0.7-28.1 php7-bcmath-7.0.7-28.1 php7-bz2-7.0.7-28.1 php7-calendar-7.0.7-28.1 php7-ctype-7.0.7-28.1 php7-curl-7.0.7-28.1 php7-dba-7.0.7-28.1 php7-devel-7.0.7-28.1 php7-dom-7.0.7-28.1 php7-enchant-7.0.7-28.1 php7-exif-7.0.7-28.1 php7-fastcgi-7.0.7-28.1 php7-fileinfo-7.0.7-28.1 php7-firebird-7.0.7-28.1 php7-fpm-7.0.7-28.1 php7-ftp-7.0.7-28.1 php7-gd-7.0.7-28.1 php7-gettext-7.0.7-28.1 php7-gmp-7.0.7-28.1 php7-iconv-7.0.7-28.1 php7-imap-7.0.7-28.1 php7-intl-7.0.7-28.1 php7-json-7.0.7-28.1 php7-ldap-7.0.7-28.1 php7-mbstring-7.0.7-28.1 php7-mcrypt-7.0.7-28.1 php7-mysql-7.0.7-28.1 php7-odbc-7.0.7-28.1 php7-opcache-7.0.7-28.1 php7-openssl-7.0.7-28.1 php7-pcntl-7.0.7-28.1 php7-pdo-7.0.7-28.1 php7-pear-7.0.7-28.1 php7-pear-Archive_Tar-7.0.7-28.1 php7-pgsql-7.0.7-28.1 php7-phar-7.0.7-28.1 php7-posix-7.0.7-28.1 php7-pspell-7.0.7-28.1 php7-readline-7.0.7-28.1 php7-shmop-7.0.7-28.1 php7-snmp-7.0.7-28.1 php7-soap-7.0.7-28.1 php7-sockets-7.0.7-28.1 php7-sqlite-7.0.7-28.1 php7-sysvmsg-7.0.7-28.1 php7-sysvsem-7.0.7-28.1 php7-sysvshm-7.0.7-28.1 php7-tidy-7.0.7-28.1 php7-tokenizer-7.0.7-28.1 php7-wddx-7.0.7-28.1 php7-xmlreader-7.0.7-28.1 php7-xmlrpc-7.0.7-28.1 php7-xmlwriter-7.0.7-28.1 php7-xsl-7.0.7-28.1 php7-zip-7.0.7-28.1 php7-zlib-7.0.7-28.1 apache2-mod_php7-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-bcmath-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-bz2-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-calendar-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-ctype-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-curl-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-dba-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-devel-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-dom-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-enchant-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-exif-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-fastcgi-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-fileinfo-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-firebird-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-fpm-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-ftp-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-gd-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-gettext-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-gmp-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-iconv-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-imap-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-intl-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-json-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-ldap-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-mbstring-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-mcrypt-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-mysql-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-odbc-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-opcache-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-openssl-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-pcntl-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-pdo-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-pear-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-pear-Archive_Tar-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-pgsql-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-phar-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-posix-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-pspell-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-readline-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-shmop-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-snmp-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-soap-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-sockets-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-sqlite-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-sysvmsg-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-sysvsem-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-sysvshm-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-tidy-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-tokenizer-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-wddx-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-xmlreader-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-xmlrpc-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-xmlwriter-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-xsl-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-zip-7.0.7-28.1 as a component of openSUSE Leap 42.3 php7-zlib-7.0.7-28.1 as a component of openSUSE Leap 42.3 gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or imagecreatefromstring PHP function. This is related to GetCode_ and gdImageCreateFromGifCtx. CVE-2018-5711 openSUSE Leap 42.3:apache2-mod_php7-7.0.7-28.1 openSUSE Leap 42.3:php7-7.0.7-28.1 openSUSE Leap 42.3:php7-bcmath-7.0.7-28.1 openSUSE Leap 42.3:php7-bz2-7.0.7-28.1 openSUSE Leap 42.3:php7-calendar-7.0.7-28.1 openSUSE Leap 42.3:php7-ctype-7.0.7-28.1 openSUSE Leap 42.3:php7-curl-7.0.7-28.1 openSUSE Leap 42.3:php7-dba-7.0.7-28.1 openSUSE Leap 42.3:php7-devel-7.0.7-28.1 openSUSE Leap 42.3:php7-dom-7.0.7-28.1 openSUSE Leap 42.3:php7-enchant-7.0.7-28.1 openSUSE Leap 42.3:php7-exif-7.0.7-28.1 openSUSE Leap 42.3:php7-fastcgi-7.0.7-28.1 openSUSE Leap 42.3:php7-fileinfo-7.0.7-28.1 openSUSE Leap 42.3:php7-firebird-7.0.7-28.1 openSUSE Leap 42.3:php7-fpm-7.0.7-28.1 openSUSE Leap 42.3:php7-ftp-7.0.7-28.1 openSUSE Leap 42.3:php7-gd-7.0.7-28.1 openSUSE Leap 42.3:php7-gettext-7.0.7-28.1 openSUSE Leap 42.3:php7-gmp-7.0.7-28.1 openSUSE Leap 42.3:php7-iconv-7.0.7-28.1 openSUSE Leap 42.3:php7-imap-7.0.7-28.1 openSUSE Leap 42.3:php7-intl-7.0.7-28.1 openSUSE Leap 42.3:php7-json-7.0.7-28.1 openSUSE Leap 42.3:php7-ldap-7.0.7-28.1 openSUSE Leap 42.3:php7-mbstring-7.0.7-28.1 openSUSE Leap 42.3:php7-mcrypt-7.0.7-28.1 openSUSE Leap 42.3:php7-mysql-7.0.7-28.1 openSUSE Leap 42.3:php7-odbc-7.0.7-28.1 openSUSE Leap 42.3:php7-opcache-7.0.7-28.1 openSUSE Leap 42.3:php7-openssl-7.0.7-28.1 openSUSE Leap 42.3:php7-pcntl-7.0.7-28.1 openSUSE Leap 42.3:php7-pdo-7.0.7-28.1 openSUSE Leap 42.3:php7-pear-7.0.7-28.1 openSUSE Leap 42.3:php7-pear-Archive_Tar-7.0.7-28.1 openSUSE Leap 42.3:php7-pgsql-7.0.7-28.1 openSUSE Leap 42.3:php7-phar-7.0.7-28.1 openSUSE Leap 42.3:php7-posix-7.0.7-28.1 openSUSE Leap 42.3:php7-pspell-7.0.7-28.1 openSUSE Leap 42.3:php7-readline-7.0.7-28.1 openSUSE Leap 42.3:php7-shmop-7.0.7-28.1 openSUSE Leap 42.3:php7-snmp-7.0.7-28.1 openSUSE Leap 42.3:php7-soap-7.0.7-28.1 openSUSE Leap 42.3:php7-sockets-7.0.7-28.1 openSUSE Leap 42.3:php7-sqlite-7.0.7-28.1 openSUSE Leap 42.3:php7-sysvmsg-7.0.7-28.1 openSUSE Leap 42.3:php7-sysvsem-7.0.7-28.1 openSUSE Leap 42.3:php7-sysvshm-7.0.7-28.1 openSUSE Leap 42.3:php7-tidy-7.0.7-28.1 openSUSE Leap 42.3:php7-tokenizer-7.0.7-28.1 openSUSE Leap 42.3:php7-wddx-7.0.7-28.1 openSUSE Leap 42.3:php7-xmlreader-7.0.7-28.1 openSUSE Leap 42.3:php7-xmlrpc-7.0.7-28.1 openSUSE Leap 42.3:php7-xmlwriter-7.0.7-28.1 openSUSE Leap 42.3:php7-xsl-7.0.7-28.1 openSUSE Leap 42.3:php7-zip-7.0.7-28.1 openSUSE Leap 42.3:php7-zlib-7.0.7-28.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-01/msg00116.html https://www.suse.com/security/cve/CVE-2018-5711.html CVE-2018-5711 https://bugzilla.suse.com/1076391 SUSE Bug 1076391 An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file. CVE-2018-5712 openSUSE Leap 42.3:apache2-mod_php7-7.0.7-28.1 openSUSE Leap 42.3:php7-7.0.7-28.1 openSUSE Leap 42.3:php7-bcmath-7.0.7-28.1 openSUSE Leap 42.3:php7-bz2-7.0.7-28.1 openSUSE Leap 42.3:php7-calendar-7.0.7-28.1 openSUSE Leap 42.3:php7-ctype-7.0.7-28.1 openSUSE Leap 42.3:php7-curl-7.0.7-28.1 openSUSE Leap 42.3:php7-dba-7.0.7-28.1 openSUSE Leap 42.3:php7-devel-7.0.7-28.1 openSUSE Leap 42.3:php7-dom-7.0.7-28.1 openSUSE Leap 42.3:php7-enchant-7.0.7-28.1 openSUSE Leap 42.3:php7-exif-7.0.7-28.1 openSUSE Leap 42.3:php7-fastcgi-7.0.7-28.1 openSUSE Leap 42.3:php7-fileinfo-7.0.7-28.1 openSUSE Leap 42.3:php7-firebird-7.0.7-28.1 openSUSE Leap 42.3:php7-fpm-7.0.7-28.1 openSUSE Leap 42.3:php7-ftp-7.0.7-28.1 openSUSE Leap 42.3:php7-gd-7.0.7-28.1 openSUSE Leap 42.3:php7-gettext-7.0.7-28.1 openSUSE Leap 42.3:php7-gmp-7.0.7-28.1 openSUSE Leap 42.3:php7-iconv-7.0.7-28.1 openSUSE Leap 42.3:php7-imap-7.0.7-28.1 openSUSE Leap 42.3:php7-intl-7.0.7-28.1 openSUSE Leap 42.3:php7-json-7.0.7-28.1 openSUSE Leap 42.3:php7-ldap-7.0.7-28.1 openSUSE Leap 42.3:php7-mbstring-7.0.7-28.1 openSUSE Leap 42.3:php7-mcrypt-7.0.7-28.1 openSUSE Leap 42.3:php7-mysql-7.0.7-28.1 openSUSE Leap 42.3:php7-odbc-7.0.7-28.1 openSUSE Leap 42.3:php7-opcache-7.0.7-28.1 openSUSE Leap 42.3:php7-openssl-7.0.7-28.1 openSUSE Leap 42.3:php7-pcntl-7.0.7-28.1 openSUSE Leap 42.3:php7-pdo-7.0.7-28.1 openSUSE Leap 42.3:php7-pear-7.0.7-28.1 openSUSE Leap 42.3:php7-pear-Archive_Tar-7.0.7-28.1 openSUSE Leap 42.3:php7-pgsql-7.0.7-28.1 openSUSE Leap 42.3:php7-phar-7.0.7-28.1 openSUSE Leap 42.3:php7-posix-7.0.7-28.1 openSUSE Leap 42.3:php7-pspell-7.0.7-28.1 openSUSE Leap 42.3:php7-readline-7.0.7-28.1 openSUSE Leap 42.3:php7-shmop-7.0.7-28.1 openSUSE Leap 42.3:php7-snmp-7.0.7-28.1 openSUSE Leap 42.3:php7-soap-7.0.7-28.1 openSUSE Leap 42.3:php7-sockets-7.0.7-28.1 openSUSE Leap 42.3:php7-sqlite-7.0.7-28.1 openSUSE Leap 42.3:php7-sysvmsg-7.0.7-28.1 openSUSE Leap 42.3:php7-sysvsem-7.0.7-28.1 openSUSE Leap 42.3:php7-sysvshm-7.0.7-28.1 openSUSE Leap 42.3:php7-tidy-7.0.7-28.1 openSUSE Leap 42.3:php7-tokenizer-7.0.7-28.1 openSUSE Leap 42.3:php7-wddx-7.0.7-28.1 openSUSE Leap 42.3:php7-xmlreader-7.0.7-28.1 openSUSE Leap 42.3:php7-xmlrpc-7.0.7-28.1 openSUSE Leap 42.3:php7-xmlwriter-7.0.7-28.1 openSUSE Leap 42.3:php7-xsl-7.0.7-28.1 openSUSE Leap 42.3:php7-zip-7.0.7-28.1 openSUSE Leap 42.3:php7-zlib-7.0.7-28.1 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2018-01/msg00116.html https://www.suse.com/security/cve/CVE-2018-5712.html CVE-2018-5712 https://bugzilla.suse.com/1076220 SUSE Bug 1076220 https://bugzilla.suse.com/1076391 SUSE Bug 1076391 https://bugzilla.suse.com/1091362 SUSE Bug 1091362