Withdrawn by the publisher.

The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, related to "type confusion" issues in (1) ArrayObject and (2) SPLObjectStorage.

The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, related to "type confusion" issues in (1) ArrayObject and (2) SPLObjectStorage.

file: out of bounds read in CDF parser php: heap-based buffer over-read in DateInterval file: cdf_unpack_summary_info() excessive looping DoS file: CDF property info parsing nelements infinite loop file: unrestricted recursion in handling of indirect type rules file: out-of-bounds access in search rules with offsets from input file file: cdf_check_stream_offset insufficient boundary check file: cdf_count_chain insufficient boundary check php: unserialize() SPL ArrayObject / SPLObjectStorage type confusion flaw php: heap-based buffer overflow in DNS TXT record parsing php: type confusion issue in phpinfo() leading to information leak

file: extensive backtracking in awk rule regular expression file: cdf_read_short_sector insufficient boundary check file: cdf_unpack_summary_info() excessive looping DoS file: CDF property info parsing nelements infinite loop file: cdf_check_stream_offset insufficient boundary check file: cdf_count_chain insufficient boundary check file: cdf_read_property_info insufficient boundary check php: unserialize() SPL ArrayObject / SPLObjectStorage type confusion flaw php: heap-based buffer overflow in DNS TXT record parsing php: type confusion issue in phpinfo() leading to information leak

Security update for php53

Affected: Ubuntu:14.04:LTS: php5

The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, related to "type confusion" issues in (1) ArrayObject and (2) SPLObjectStorage.