[gentoo-announce] [ GLSA 201503-03 ] PHP: Multiple vulnerabilities

Fabricante: Gentoo
Fecha: 08/03/2015
Identificador: GLSA 201503-03
[gentoo-announce] [ GLSA 201503-03 ] PHP: Multiple vulnerabilities
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201503-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: PHP: Multiple vulnerabilities Date: March 08, 2015 Bugs: #530820, #532914, #533998 ID: 201503-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been discovered in PHP, the worst of which could lead to remote execution of arbitrary code. Background ========== PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-lang/php < 5.5.21 >= 5.5.21 *>= 5.4.37 *>= 5.4.38 *>= 5.4.39 Description =========== Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker can leverage these vulnerabilities to execute arbitrary code or cause Denial of Service. Workaround ========== There is no known workaround at this time. Resolution ========== All PHP 5.5 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.5.21" All PHP 5.4 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.4.37" All PHP 5.3 users should upgrade to the latest version. This branch is currently past the end of life and it will no longer receive security fixes. All PHP 5.3 users are strongly recommended to upgrade to the current stable version of PHP 5.5 or previous stable version of PHP 5.4, which are supported till at least 2016 and 2015 respectively. References ========== [ 1 ] CVE-2014-3710 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3710 [ 2 ] CVE-2014-8142 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8142 [ 3 ] CVE-2014-9425 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9425 [ 4 ] CVE-2014-9427 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-9427 [ 5 ] CVE-2015-0231 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0231 [ 6 ] CVE-2015-0232 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0232 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201503-03.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJU/FpSAAoJEP7VAChXwav6P5oIALiem7pEiyKdkqLu2Q4eFn1l od5NHFmgNmMO4NMirLo3RtTVjNZr/RRa/JZy/cB6923o277P60Wd8JE/Jm5BeYeE Xtg5WeIA3spGAwxtfMh6HfDT3YURnVCUDCcalmDBKWOCxf0bymPMz7B924BZKexO b0DkIJppzdD0wakKv2p5+EkD9IJx9p34UDnFN5rKpw+uJUaHqMNJBT8zqLT6ECKX K2ynGtuxeZMXjd6JYs1Yeal90f8ONeLL0HiRWuS9EDFk7qRA4uYnuV4MlTmb85Nq kPuVdt1mNBds6iozK67nyOrsbLgKOQ7lKKzclVnTzHbiioH2y4p7jusx2dCgq/E= =/CaR -----END PGP SIGNATURE-----