Recent Vulnerabilities Research Posts Trends Blog About Contact

Related Vulnerabilities: CVE-2015-6834 CVE-2015-6835 CVE-2015-6836 CVE-2015-6837 CVE-2015-6838 CVE-2015-7803 CVE-2015-7804

As <a href="https://bugs.php.net/bug.php?id=69720">reported upstream</a>, A NULL pointer dereference flaw was found in the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash. (CVE-2015-7803 ) A flaw was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2015-6834, CVE-2015-6835, CVE-2015-6836) A NULL pointer dereference flaw was found in the XSLTProcessor class in PHP. An attacker could use this flaw to cause a PHP application to crash if it performed Extensible Stylesheet Language (XSL) transformations using untrusted XSLT files and allowed the use of PHP functions to be used as XSLT functions within XSL stylesheets. (CVE-2015-6837, CVE-2015-6838) As <a href="https://bugs.php.net/bug.php?id=70433">reported upstream</a>, an uninitialized pointer use flaw was found in the phar_make_dirstream() function of PHP's Phar extension. A specially crafted phar file in the ZIP format with a directory entry with a file name "/ZIP" could cause a PHP application function to crash. (CVE-2015-7804)

Source

ALAS-2015-602

Amazon Linux AMI Security Advisory: ALAS-2015-602
Advisory Release Date: 2015-10-20 14:52 Pacific
Advisory Updated Date: 2016-03-16 16:30 Pacific

Severity: Medium

References: CVE-2015-6834 CVE-2015-6835 CVE-2015-6836 CVE-2015-6837 CVE-2015-6838 CVE-2015-7803 CVE-2015-7804

Issue Overview:

As <a href="https://bugs.php.net/bug.php?id=69720">reported upstream</a>, A NULL pointer dereference flaw was found in the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash. (CVE-2015-7803 )

A flaw was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2015-6834, CVE-2015-6835, CVE-2015-6836)

A NULL pointer dereference flaw was found in the XSLTProcessor class in PHP. An attacker could use this flaw to cause a PHP application to crash if it performed Extensible Stylesheet Language (XSL) transformations using untrusted XSLT files and allowed the use of PHP functions to be used as XSLT functions within XSL stylesheets. (CVE-2015-6837, CVE-2015-6838)

As <a href="https://bugs.php.net/bug.php?id=70433">reported upstream</a>, an uninitialized pointer use flaw was found in the phar_make_dirstream() function of PHP's Phar extension. A specially crafted phar file in the ZIP format with a directory entry with a file name "/ZIP" could cause a PHP application function to crash. (CVE-2015-7804)

Affected Packages:

php55

Issue Correction:
Run yum update php55 to update your system.

New Packages:

i686:
    php55-embedded-5.5.30-1.110.amzn1.i686
    php55-bcmath-5.5.30-1.110.amzn1.i686
    php55-snmp-5.5.30-1.110.amzn1.i686
    php55-cli-5.5.30-1.110.amzn1.i686
    php55-mbstring-5.5.30-1.110.amzn1.i686
    php55-ldap-5.5.30-1.110.amzn1.i686
    php55-pgsql-5.5.30-1.110.amzn1.i686
    php55-pdo-5.5.30-1.110.amzn1.i686
    php55-pspell-5.5.30-1.110.amzn1.i686
    php55-dba-5.5.30-1.110.amzn1.i686
    php55-common-5.5.30-1.110.amzn1.i686
    php55-odbc-5.5.30-1.110.amzn1.i686
    php55-enchant-5.5.30-1.110.amzn1.i686
    php55-xml-5.5.30-1.110.amzn1.i686
    php55-soap-5.5.30-1.110.amzn1.i686
    php55-fpm-5.5.30-1.110.amzn1.i686
    php55-gmp-5.5.30-1.110.amzn1.i686
    php55-xmlrpc-5.5.30-1.110.amzn1.i686
    php55-opcache-5.5.30-1.110.amzn1.i686
    php55-process-5.5.30-1.110.amzn1.i686
    php55-debuginfo-5.5.30-1.110.amzn1.i686
    php55-mcrypt-5.5.30-1.110.amzn1.i686
    php55-5.5.30-1.110.amzn1.i686
    php55-devel-5.5.30-1.110.amzn1.i686
    php55-imap-5.5.30-1.110.amzn1.i686
    php55-mssql-5.5.30-1.110.amzn1.i686
    php55-mysqlnd-5.5.30-1.110.amzn1.i686
    php55-recode-5.5.30-1.110.amzn1.i686
    php55-tidy-5.5.30-1.110.amzn1.i686
    php55-intl-5.5.30-1.110.amzn1.i686
    php55-gd-5.5.30-1.110.amzn1.i686

src:
    php55-5.5.30-1.110.amzn1.src

x86_64:
    php55-cli-5.5.30-1.110.amzn1.x86_64
    php55-pdo-5.5.30-1.110.amzn1.x86_64
    php55-odbc-5.5.30-1.110.amzn1.x86_64
    php55-common-5.5.30-1.110.amzn1.x86_64
    php55-tidy-5.5.30-1.110.amzn1.x86_64
    php55-mbstring-5.5.30-1.110.amzn1.x86_64
    php55-intl-5.5.30-1.110.amzn1.x86_64
    php55-mysqlnd-5.5.30-1.110.amzn1.x86_64
    php55-mcrypt-5.5.30-1.110.amzn1.x86_64
    php55-fpm-5.5.30-1.110.amzn1.x86_64
    php55-process-5.5.30-1.110.amzn1.x86_64
    php55-dba-5.5.30-1.110.amzn1.x86_64
    php55-pspell-5.5.30-1.110.amzn1.x86_64
    php55-recode-5.5.30-1.110.amzn1.x86_64
    php55-mssql-5.5.30-1.110.amzn1.x86_64
    php55-debuginfo-5.5.30-1.110.amzn1.x86_64
    php55-bcmath-5.5.30-1.110.amzn1.x86_64
    php55-xml-5.5.30-1.110.amzn1.x86_64
    php55-imap-5.5.30-1.110.amzn1.x86_64
    php55-opcache-5.5.30-1.110.amzn1.x86_64
    php55-soap-5.5.30-1.110.amzn1.x86_64
    php55-5.5.30-1.110.amzn1.x86_64
    php55-xmlrpc-5.5.30-1.110.amzn1.x86_64
    php55-embedded-5.5.30-1.110.amzn1.x86_64
    php55-snmp-5.5.30-1.110.amzn1.x86_64
    php55-devel-5.5.30-1.110.amzn1.x86_64
    php55-enchant-5.5.30-1.110.amzn1.x86_64
    php55-gd-5.5.30-1.110.amzn1.x86_64
    php55-gmp-5.5.30-1.110.amzn1.x86_64
    php55-ldap-5.5.30-1.110.amzn1.x86_64
    php55-pgsql-5.5.30-1.110.amzn1.x86_64

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

ALAS-2015-602

ALAS-2015-602

Vulmon Search

About

Products

Connect