Most recent entries from all

ALSA-2020:1624 — Moderate: php:7.2 security, bug fix, and enhancement update

Affected: AlmaLinux:8: apcu-panel, AlmaLinux:8: libzip, AlmaLinux:8: libzip-devel, AlmaLinux:8: libzip-tools, AlmaLinux:8: php, AlmaLinux:8: php-bcmath, AlmaLinux:8: php-cli, AlmaLinux:8: php-common, AlmaLinux:8: php-dba, AlmaLinux:8: php-dbg and 25 more

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

The following packages have been upgraded to a later upstream version: php (7.2.24). (BZ#1726981)

Security Fix(es):

* php: Invalid memory access in function xmlrpc_decode() (CVE-2019-9020)

* php: File rename across filesystems may allow unwanted access during processing (CVE-2019-9637)

* php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9638)

* php: Uninitialized read in exif_process_IFD_in_MAKERNOTE (CVE-2019-9639)

* php: Invalid read in exif_process_SOFn() (CVE-2019-9640)

* php: Out-of-bounds read due to integer overflow in iconv_mime_decode_headers() (CVE-2019-11039)

* php: Buffer over-read in exif_read_data() (CVE-2019-11040)

* php: Buffer over-read in PHAR reading functions (CVE-2018-20783)

* php: Heap-based buffer over-read in PHAR reading functions (CVE-2019-9021)

* php: memcpy with negative length via crafted DNS response (CVE-2019-9022)

* php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

* php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c (CVE-2019-9024)

* php: Heap buffer overflow in function exif_process_IFD_TAG() (CVE-2019-11034)

* php: Heap buffer overflow in function exif_iif_add_value() (CVE-2019-11035)

* php: Buffer over-read in exif_process_IFD_TAG() leading to information disclosure (CVE-2019-11036)

* php: Heap buffer over-read in exif_scan_thumbnail() (CVE-2019-11041)…

bdu:2020-03142

certfr-2025-avi-0106 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2025-avi-0106

cnvd-2019-24791

EUVD-2026-53043

fkie_cve-2019-9639

An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_MAKERNOTE because of mishandling the data_len variable.

FSA-202302 — Festo: Several vulnerabilities in FactoryViews

FactoryViews bundles many third-party applications which are used in background processes to provide the software's features. From time to time, vulnerabilities in these bundled applications are discovered. These are typically fixed in newer versions of FactoryViews by updating the bundled applications.

FactoryViews versions up to and including 1.5.2 contain around 200 such vulnerabilities listed in this advisory.Version 1.6.0 is a security rollup release which includes updates to all bundled applications and fixes these vulnerabilities.

At this time, FactoryViews Lite cannot be updated beyond version 1.1. FactoryViews 1.7 unifies the non-Lite and Lite versions and fixes these vulnerabilities for users of FactoryViews Lite.

GHSA-h9xv-q955-564m

gsd-2019-9639

ICSA-26-027-02 — Festo Didactic SE MES PC

MES PCs shipped with Windows 10 come pre-installed with XAMPP. XAMPP is a bundle of third-party open-source applications including the Apache HTTP Server, the MariaDB database and more. From time to time, vulnerabilities in these applications are discovered. These are fixed in newer versions of XAMPP by updating the bundled applications.

MES PCs shipped with Windows 10 include a copy of XAMPP which contains around 140 such vulnerabilities listed in this advisory. They can be fixed by replacing XAMPP with Festo Didactic's Factory Control Panel application.

openSUSE-SU-2019:1572-1 — Security update for php7

Security update for php7

RHSA-2019:2519 — Red Hat Security Advisory: rh-php71-php security, bug fix, and enhancement update

gd: Unsigned integer underflow _gdContributionsAlloc() php: Out of bounds access in php_pcre.c:php_pcre_replace_impl() php: Integer overflow in mysqli_api.c:mysqli_real_escape_string() php: Heap use after free in ext/standard/var_unserializer.re php: Out-of-bound read in timelib_meridian() gd: Infinite loop in gdImageCreateFromGifCtx() in gd_gif_in.c php: Reflected XSS on PHAR 404 page php: Stack-based buffer under-read in php_stream_url_wrap_http_ex() in http_fopen_wrapper.c when parsing HTTP response php: Dumpable FPM child processes allow bypassing opcache access controls php: Infinite loop in ext/iconv/iconv.c when using stream filter with convert.incov on invalid sequence leads to denial-of-service php: Reflected XSS vulnerability on PHAR 403 and 404 error pages php: NULL pointer dereference due to mishandling of ldap_get_dn return value allows DoS via malicious LDAP server reply php: Out-of-bounds read in ext/exif/exif.c:exif_read_data() when reading crafted JPEG data php: exif: Buffer over-read in exif_process_IFD_in_MAKERNOTE() php: Mishandled http_header_value in an atoi() call in http_fopen_wrapper.c php: Cross-site scripting (XSS) flaw in Apache2 component via body of 'Transfer-Encoding: chunked' request php: Buffer over-read in PHAR reading functions gd: Heap-based buffer overflow in gdImageColorMatch() in gd_color_match.c php: Invalid memory access in function xmlrpc_decode() php: Heap-based buffer over-read in PHAR reading functions php: memcpy with negative le…

SUSE-SU-2019:0988-1 — Security update for php72

Security update for php72

UBUNTU-CVE-2019-9639

Affected: Ubuntu:14.04:LTS: php5, Ubuntu:16.04:LTS: php7.0, Ubuntu:18.04:LTS: php7.2