Search results

Query:
Filters:	Content type Categories  LWN Feature article  Guest article  News item  Email item  Security alert  Security vulnerability  Kernel patch  Comment  Announcements  Briefs  Commerce  Development  Distributions  Front  Kernel  Legal  Letters  Press  Security  Select all  Select all
Order by:	relevance date

Search results

openSUSE security update to php5
([Security] Posted Oct 5, 2016 15:59 UTC (Wed) by ris )

CVE-2016-7126 CVE-2016-7127
                    CVE-2016-7128 CVE-2016-7129 CVE-2016-7130
                    CVE-2016-7131 CVE-2016-7132 CVE-2016-7134
                   
Affected Products:
                    openSUSE Leap 42.1
______________________________________________________________________________

   An update that fixes 24 vulnerabilities is now available.

Description:


   This update for php5 fixes the following security issues:

   * CVE-2016-6128: Invalid color index not properly handled [bsc#987580]
   * CVE-2016-6161: global out of bounds read when encoding gif from
     malformed input withgd2togif [bsc#988032]
   * CVE-2016-6292: Null pointer dereference in exif_process_user_comment
     [bsc#991422]
   * CVE-2016-6295: Use after free in SNMP with GC and unserialize()
     [bsc#991424]
   * CVE-2016-6297: Stack-based buffer overflow vulnerability in
     php_stream_zip_opener [bsc#991426]
   * CVE-2016-6291: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE
     [bsc#991427]
   * CVE-2016-6289: Integer overflow leads to buffer overflow in
     virtual_file_ex [bsc#991428]
   * CVE-2016-6290: Use after free in unserialize() with Unexpected Session
     Deserialization [bsc#991429]
   * CVE-2016-5399: Improper error handling in bzread() [bsc#991430]
   * CVE-2016-6296: Heap buffer overflow vulnerability in simplestring_addn
     in simplestring.c [bsc#991437]
   * CVE-2016-6207: Integer overflow error within _gdContributionsAlloc()
     [bsc#991434]
   * CVE-2014-3587

SUSE security update to php5
([Security] Posted Sep 28, 2016 16:07 UTC (Wed) by ris )

CVE-2014-3587 CVE-2016-3587 CVE-2016-5399
                    CVE-2016-6128 CVE-2016-6161 CVE-2016-6207
                    CVE-2016-6288 CVE-2016-6289 CVE-2016-6290
                    CVE-2016-6291 CVE-2016-6292 CVE-2016-6295
                    CVE-2016-6296 CVE-2016-6297 CVE-2016-7124
                    CVE-2016-7125 CVE-2016-7126 CVE

SUSE security update to php53
([Security] Posted Sep 19, 2016 15:50 UTC (Mon) by ris )

CVE-2014-3587 CVE-2016-3587 CVE-2016-5399
                    CVE-2016-6288 CVE-2016-6289 CVE-2016-6290
                    CVE-2016-6291 CVE-2016-6296 CVE-2016-6297
                    CVE-2016-7124 CVE-2016-7125 CVE-2016-7126
                    CVE-2016-7127 CVE-2016-7128 CVE-2016-7129
                    CVE-2016-7130 CVE-2016-7131 CVE

Scientific Linux security update to file
([Security] Posted Jun 9, 2016 16:31 UTC (Thu) by jake )

CVE-2014-3538
                   CVE-2014-3710
                   CVE-2014-8116
                   CVE-2014-8117
                   CVE-2014-9653
                   CVE-2014-9620
--

Security Fix(es):

* Multiple flaws were found in the file regular expression rules for
detecting various files. A remote attacker could use these flaws to cause
file to consume an excessive amount of CPU. (CVE-2014-3538)

* A denial of service flaw was found in the way file parsed certain
Composite Document Format (CDF) files. A remote attacker could use this
flaw to crash file via a specially crafted CDF file. (CVE-2014-3587

Oracle security update to file
([Security] Posted May 16, 2016 16:23 UTC (Mon) by ris )

CVE-2014-3587 (incomplete fix for CVE-2012-1571)
- fix CVE-2014-3710 (out-of-bounds read in elf note headers)
- fix CVE-2014-8116 (multiple DoS issues (resource consumption))
- fix CVE-2014-8117 (denial of service issue (resource consumption))
- fix CVE-2014-9620 (limit the number of ELF notes

Red Hat security update to file
([Security] Posted May 11, 2016 15:31 UTC (Wed) by ris )

CVE-2014-3710, CVE-2014-8116, CVE-2014-8117,
CVE-2014-9620, CVE-2014-9653)

Red Hat would like to thank Thomas Jarosch (Intra2net AG) for reporting
CVE-2014-8116 and CVE-2014-8117. The CVE-2014-3538 issue was discovered by
Jan Kaluža (Red Hat Web Stack Team) and the CVE-2014-3710 issue was
discovered by Francisco Alonso (Red Hat Product Security).

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 6.8 Release Notes and Red Hat Enterprise Linux 6.8
Technical Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

 https://access.redhat.com/articles/11258 

5. Bugs fixed ( https://bugzilla.redhat.com/ ):

809898 - RFE: add detection of Python bytecode for recent versions of Python
1080453 - file: incorrectly applied magic/Magdir patch [rhel-6]
1098222 - CVE-2014-3538 file: unrestricted regular expression matching
1128587 - CVE-2014-3587

Scientific Linux security update to file
([Security] Posted Dec 22, 2015 17:10 UTC (Tue) by ris )

CVE Numbers:       CVE-2014-0238
                   CVE-2014-0237
                   CVE-2014-3480
                   CVE-2014-3479
                   CVE-2014-0207
                   CVE-2014-3487
                   CVE-2014-3587
                   CVE-2014-3538
                   CVE-2014-3478
                   CVE-2014-3710
                   CVE-2014-9652
                   CVE-2014-8116
                   CVE-2014-8117
                   CVE-2014-9653
--

Multiple denial of service flaws were

Oracle security update to file
([Security] Posted Nov 24, 2015 17:35 UTC (Tue) by ris )

CVE-2014-8116 - bump the acceptable ELF program headers count to 2048

[5.11-29]
- fix #839229 - fix detection of version of XML files

[5.11-28]
- fix #839229 - fix detection of version of XML files

[5.11-27]
- fix CVE-2014-0207 - cdf_read_short_sector insufficient boundary check
- fix CVE-2014-0237 - cdf_unpack_summary_info() excessive looping DoS
- fix CVE-2014-0238 - CDF property info parsing nelements infinite loop
- fix CVE-2014-3478 - mconvert incorrect handling of truncated pascal string
- fix CVE-2014-3479 - fix extensive backtracking in regular expression
- fix CVE-2014-3480 - cdf_count_chain insufficient boundary check
- fix CVE-2014-3487 - cdf_read_property_info insufficient boundary check
- fix CVE-2014-3538 - unrestricted regular expression matching
- fix CVE-2014-3587

Red Hat security update to file
([Security] Posted Nov 20, 2015 17:05 UTC (Fri) by n8willis )

CVE Names:         CVE-2014-0207 CVE-2014-0237 CVE-2014-0238 
                   CVE-2014-3478 CVE-2014-3479 CVE-2014-3480 
                   CVE-2014-3487 CVE-2014-3538 CVE-2014-3587 
                   CVE-2014-3710 CVE-2014-8116 CVE-2014-8117 
                   CVE-2014-9652 CVE-2014-9653 
=====================================================================

1. Summary:

Updated file packages that

Oracle security update to php
([Security] Posted Jun 24, 2015 16:54 UTC (Wed) by ris )

CVE-2015-2348
- date: use after free vulnerability in unserialize CVE-2015-0273
- enchant: fix heap buffer overflow in enchant_broker_request_dict
   CVE-2014-9705
- exif: free called on unitialized pointer CVE-2015-0232
- fileinfo: fix out of bounds read in mconvert CVE-2014-9652
- gd: fix buffer read overflow in gd_gif_in.c CVE-2014-9709
- phar: use after free in phar_object.c CVE-2015-2301
- soap: fix type confusion through unserialize

[5.4.16-31]
- fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710

[5.4.16-29]
- xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
- core: fix integer overflow in unserialize() CVE-2014-3669
- exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670

[5.4.16-27]
- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
   CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- fileinfo: fix extensive backtracking in regular expression
   (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: fix mconvert incorrect handling of truncated
   pascal string size. CVE-2014-3478
- fileinfo: fix cdf_read_property_info
   (incomplete fix for CVE-2012-1571). CVE-2014-3587

Mandriva security update to php
([Security] Posted Mar 29, 2015 17:10 UTC (Sun) by corbet )

CVE-2014-4698).
 
 Use-after-free vulnerability in ext/spl/spl_dllist.c in the SPL
 component in PHP through 5.5.14 allows context-dependent attackers to
 cause a denial of service or possibly have unspecified other impact
 via crafted iterator usage within applications in certain web-hosting
 environments (CVE-2014-4670).
 
 file before 5.19 does not properly restrict the amount of data read
 during a regex search, which allows remote attackers to cause a
 denial of service (CPU consumption) via a crafted file that triggers
 backtracking during processing of an awk rule, due to an incomplete
 fix for CVE-2013-7345 (CVE-2014-3538).
 
 Integer overflow in the cdf_read_property_info function in cdf.c
 in file through 5.19, as used in the Fileinfo component in PHP
 before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to
 cause a denial of service (application crash) via a crafted CDF
 file. NOTE: this vulnerability exists because of an incomplete fix
 for CVE-2012-1571 (CVE-2014-3587

Red Hat security update to php55-php
([Security] Posted Oct 31, 2014 16:21 UTC (Fri) by n8willis )

CVE Names:         CVE-2014-0207 CVE-2014-0237 CVE-2014-0238 
                   CVE-2014-2497 CVE-2014-3478 CVE-2014-3479 
                   CVE-2014-3480 CVE-2014-3487 CVE-2014-3515 
                   CVE-2014-3538 CVE-2014-3587 CVE-2014-3597 
                   CVE-2014-3668 CVE-2014-3669 CVE-2014-3670 
                   CVE-2014-3710 CVE

Red Hat security update to php54-php
([Security] Posted Oct 31, 2014 16:21 UTC (Fri) by n8willis )

CVE-2014-0207 
                   CVE-2014-0237 CVE-2014-0238 CVE-2014-1943 
                   CVE-2014-2270 CVE-2014-2497 CVE-2014-3478 
                   CVE-2014-3479 CVE-2014-3480 CVE-2014-3487 
                   CVE-2014-3515 CVE-2014-3538 CVE-2014-3587 
                   CVE-2014-3597 CVE-2014-3668 CVE-2014-3669 
                   CVE-2014

Fedora security update to file
([Security] Posted Oct 29, 2014 16:02 UTC (Wed) by ris )

-2014-13571
2014-10-27 02:21:35
--------------------------------------------------------------------------------

Name        : file
Product     : Fedora 20
Version     : 5.19
Release     : 7.fc20
URL         :  http://www.darwinsys.com/file/ 
Summary     : A utility for determining file types
Description :
The file command is used to identify a particular file according to the
type of data contained by the file.  File can identify many different
file types, including ELF binaries, system libraries, RPM packages, and
different graphics formats.

--------------------------------------------------------------------------------
Update Information:

Security fix for CVE-2014-3710
--------------------------------------------------------------------------------
ChangeLog:

* Thu Oct 23 2014 Jan Kaluza <jkaluza@redhat.com> - 5.19-7
- fix #1155464 - fix for CVE-2014-3710
* Wed Sep  3 2014 Jan Kaluza <jkaluza@redhat.com> - 5.19-6
- fix #1134580 - detect Mach-O universal binary
* Wed Sep  3 2014 Jan Kaluza <jkaluza@redhat.com> - 5.19-5
- fix #1101404 - remove weak Pascal patterns
- fix #1107995 - detect locale-archive
- fix #1130693, #1115111 - fix detection of MSOOXML, OOXML and ZIP
- fix #1124940 - detect Python 3.4 byte-compiled files
* Fri Aug 22 2014 Jan Kaluza <jkaluza@redhat.com> - 5.19-4
- fix #1132787 - CVE-2014-3587

Scientific Linux security update to php53 and php
([Security] Posted Oct 14, 2014 16:46 UTC (Tue) by ris )

-2014:1326-1
Issue Date:        2014-09-30
CVE Numbers:       CVE-2014-2497
                   CVE-2014-4698
                   CVE-2014-4670
                   CVE-2014-3587
                   CVE-2014-3597
--

It was found that the fix for CVE-2012-1571 was incomplete; the File
Information (fileinfo) extension did not correctly parse certain Composite
Document Format

Ubuntu security update to file
([Security] Posted Oct 3, 2014 13:38 UTC (Fri) by n8willis )

Ubuntu 10.04 LTS:
  file                            5.03-5ubuntu1.4

In general, a standard system update will make all the necessary changes.

References:
   http://www.ubuntu.com/usn/usn-2369-1
 
  CVE-2014-3587

Package Information:
   https://launchpad.net/ubuntu/+source/file/1:5.14-2ubuntu3.2
 
   https://launchpad.net/ubuntu/+source/file/5.09-2ubuntu0.5
 
   https://launchpad.net/ubuntu/+source/file/5.03-5ubuntu1.4
 

-- 
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at:
 https://lists.ubuntu.com/mailman/listinfo/ubuntu-security... 
 

Oracle security update to php
([Security] Posted Sep 30, 2014 17:02 UTC (Tue) by ris )

-2014-1326 Moderate: Oracle Linux 6 php53 and php security update   
   Date : 
    	         Tue, 30 Sep 2014 08:11:08 -0700  
   Message-ID : 
    	         <542AC80C.4060402@oracle.com>  
  Oracle Linux Security Advisory ELSA-2014-1326

 https://rhn.redhat.com/errata/RHSA-2014-1326.html 

The following updated rpms for Oracle Linux 6 have been uploaded to the 
Unbreakable Linux Network:

i386:
php-5.3.3-27.el6_5.2.i686.rpm
php-bcmath-5.3.3-27.el6_5.2.i686.rpm
php-cli-5.3.3-27.el6_5.2.i686.rpm
php-common-5.3.3-27.el6_5.2.i686.rpm
php-dba-5.3.3-27.el6_5.2.i686.rpm
php-devel-5.3.3-27.el6_5.2.i686.rpm
php-embedded-5.3.3-27.el6_5.2.i686.rpm
php-enchant-5.3.3-27.el6_5.2.i686.rpm
php-fpm-5.3.3-27.el6_5.2.i686.rpm
php-gd-5.3.3-27.el6_5.2.i686.rpm
php-imap-5.3.3-27.el6_5.2.i686.rpm
php-intl-5.3.3-27.el6_5.2.i686.rpm
php-ldap-5.3.3-27.el6_5.2.i686.rpm
php-mbstring-5.3.3-27.el6_5.2.i686.rpm
php-mysql-5.3.3-27.el6_5.2.i686.rpm
php-odbc-5.3.3-27.el6_5.2.i686.rpm
php-pdo-5.3.3-27.el6_5.2.i686.rpm
php-pgsql-5.3.3-27.el6_5.2.i686.rpm
php-process-5.3.3-27.el6_5.2.i686.rpm
php-pspell-5.3.3-27.el6_5.2.i686.rpm
php-recode-5.3.3-27.el6_5.2.i686.rpm
php-snmp-5.3.3-27.el6_5.2.i686.rpm
php-soap-5.3.3-27.el6_5.2.i686.rpm
php-tidy-5.3.3-27.el6_5.2.i686.rpm
php-xml-5.3.3-27.el6_5.2.i686.rpm
php-xmlrpc-5.3.3-27.el6_5.2.i686.rpm
php-zts-5.3.3-27.el6_5.2.i686.rpm

x86_64:
php-5.3.3-27.el6_5.2.x86_64.rpm
php-bcmath-5.3.3-27.el6_5.2.x86_64.rpm
php-cli-5.3.3-27.el6_5.2.x86_64.rpm
php-common-5.3.3-27.el6_5.2.x86_64.rpm
php-dba-5.3.3-27.el6_5.2.x86_64.rpm
php-devel-5.3.3-27.el6_5.2.x86_64.rpm
php-embedded-5.3.3-27.el6_5.2.x86_64.rpm
php-enchant-5.3.3-27.el6_5.2.x86_64.rpm
php-fpm-5.3.3-27.el6_5.2.x86_64.rpm
php-gd-5.3.3-27.el6_5.2.x86_64.rpm
php-imap-5.3.3-27.el6_5.2.x86_64.rpm
php-intl-5.3.3-27.el6_5.2.x86_64.rpm
php-ldap-5.3.3-27.el6_5.2.x86_64.rpm
php-mbstring-5.3.3-27.el6_5.2.x86_64.rpm
php-mysql-5.3.3-27.el6_5.2.x86_64.rpm
php-odbc-5.3.3-27.el6_5.2.x86_64.rpm
php-pdo-5.3.3-27.el6_5.2.x86_64.rpm
php-pgsql-5.3.3-27.el6_5.2.x86_64.rpm
php-process-5.3.3-27.el6_5.2.x86_64.rpm
php-pspell-5.3.3-27.el6_5.2.x86_64.rpm
php-recode-5.3.3-27.el6_5.2.x86_64.rpm
php-snmp-5.3.3-27.el6_5.2.x86_64.rpm
php-soap-5.3.3-27.el6_5.2.x86_64.rpm
php-tidy-5.3.3-27.el6_5.2.x86_64.rpm
php-xml-5.3.3-27.el6_5.2.x86_64.rpm
php-xmlrpc-5.3.3-27.el6_5.2.x86_64.rpm
php-zts-5.3.3-27.el6_5.2.x86_64.rpm


SRPMS:
 http://oss.oracle.com/ol6/SRPMS-updates/php-5.3.3-27.el6_... 



Description of changes:

[5.3.3-27.2]
- spl: fix use-after-free in ArrayIterator due to object
   change during sorting. CVE-2014-4698
- spl: fix use-after-free in SPL Iterators. CVE-2014-4670
- gd: fix NULL pointer dereference in gdImageCreateFromXpm.
   CVE-2014-2497
- fileinfo: fix incomplete fix for CVE-2012-1571 in
   cdf_read_property_info. CVE-2014-3587

Oracle security update to php
([Security] Posted Sep 30, 2014 17:01 UTC (Tue) by ris )

-2014-1327 Moderate: Oracle Linux 7 php security update   
   Date : 
    	         Tue, 30 Sep 2014 07:53:11 -0700  
   Message-ID : 
    	         <542AC3D7.70804@oracle.com>  
  Oracle Linux Security Advisory ELSA-2014-1327

 https://access.redhat.com/errata/RHSA-2014:1327.html 

The following updated rpms for Oracle Linux 7 have been uploaded to the 
Unbreakable Linux Network:

x86_64:
php-5.4.16-23.el7_0.1.x86_64.rpm
php-bcmath-5.4.16-23.el7_0.1.x86_64.rpm
php-cli-5.4.16-23.el7_0.1.x86_64.rpm
php-common-5.4.16-23.el7_0.1.x86_64.rpm
php-dba-5.4.16-23.el7_0.1.x86_64.rpm
php-devel-5.4.16-23.el7_0.1.x86_64.rpm
php-embedded-5.4.16-23.el7_0.1.x86_64.rpm
php-enchant-5.4.16-23.el7_0.1.x86_64.rpm
php-fpm-5.4.16-23.el7_0.1.x86_64.rpm
php-gd-5.4.16-23.el7_0.1.x86_64.rpm
php-intl-5.4.16-23.el7_0.1.x86_64.rpm
php-ldap-5.4.16-23.el7_0.1.x86_64.rpm
php-mbstring-5.4.16-23.el7_0.1.x86_64.rpm
php-mysql-5.4.16-23.el7_0.1.x86_64.rpm
php-mysqlnd-5.4.16-23.el7_0.1.x86_64.rpm
php-odbc-5.4.16-23.el7_0.1.x86_64.rpm
php-pdo-5.4.16-23.el7_0.1.x86_64.rpm
php-pgsql-5.4.16-23.el7_0.1.x86_64.rpm
php-process-5.4.16-23.el7_0.1.x86_64.rpm
php-pspell-5.4.16-23.el7_0.1.x86_64.rpm
php-recode-5.4.16-23.el7_0.1.x86_64.rpm
php-snmp-5.4.16-23.el7_0.1.x86_64.rpm
php-soap-5.4.16-23.el7_0.1.x86_64.rpm
php-xml-5.4.16-23.el7_0.1.x86_64.rpm
php-xmlrpc-5.4.16-23.el7_0.1.x86_64.rpm


SRPMS:
 http://oss.oracle.com/ol7/SRPMS-updates/php-5.4.16-23.el7... 

Description of changes:

[5.4.16-23.1]
- gd: fix NULL pointer dereference in gdImageCreateFromXpm().
   CVE-2014-2497
- gd: fix NUL byte injection in file names. CVE-2014-5120
- fileinfo: fix extensive backtracking in regular expression
   (incomplete fix for CVE-2013-7345). CVE-2014-3538
- fileinfo: fix mconvert incorrect handling of truncated
   pascal string size. CVE-2014-3478
- fileinfo: fix cdf_read_property_info
   (incomplete fix for CVE-2012-1571). CVE-2014-3587

Red Hat security update to php
([Security] Posted Sep 30, 2014 16:26 UTC (Tue) by ris )

CVE-2014-3597)

Two use-after-free flaws were found in the way PHP handled certain Standard
PHP Library (SPL) Iterators and ArrayIterators. A malicious script author
could possibly use either of these flaws to disclose certain portions of
server memory. (CVE-2014-4670, CVE-2014-4698)

The CVE-2014-3597 issue was discovered by David Kutálek of the Red Hat
BaseOS QE.

All php53 and php users are advised to upgrade to these updated packages,
which contain backported patches to correct these issues. After installing
the updated packages, the httpd daemon must be restarted for the update to
take effect.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
 https://access.redhat.com/articles/11258 

5. Bugs fixed ( https://bugzilla.redhat.com/ ):

1076676 - CVE-2014-2497 gd: NULL pointer dereference in gdImageCreateFromXpm()
1120259 - CVE-2014-4698 php: ArrayIterator use-after-free due to object change during sorting
1120266 - CVE-2014-4670 php: SPL Iterators use-after-free
1128587 - CVE-2014-3587

Red Hat security update to php
([Security] Posted Sep 30, 2014 16:24 UTC (Tue) by ris )

-2014-4698)

The CVE-2014-3478 issue was discovered by Francisco Alonso of Red Hat
Product Security, the CVE-2014-3538 issue was discovered by Jan Kaluža of
the Red Hat Web Stack Team, and the CVE-2014-3597 issue was discovered by
David Kutálek of the Red Hat BaseOS QE.

All php users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues. After installing the
updated packages, the httpd daemon must be restarted for the update to
take effect.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
 https://access.redhat.com/articles/11258 

5. Bugs fixed ( https://bugzilla.redhat.com/ ):

1076676 - CVE-2014-2497 gd: NULL pointer dereference in gdImageCreateFromXpm()
1098222 - CVE-2014-3538 file: unrestricted regular expression matching
1104863 - CVE-2014-3478 file: mconvert incorrect handling of truncated pascal string size
1120259 - CVE-2014-4698 php: ArrayIterator use-after-free due to object change during sorting
1120266 - CVE-2014-4670 php: SPL Iterators use-after-free
1128587 - CVE-2014-3587

Debian security update to file
([Security] Posted Sep 11, 2014 13:57 UTC (Thu) by jake )

CVE ID         : CVE-2014-0207 CVE-2014-0237 CVE-2014-0238 CVE-2014-3478
                 CVE-2014-3479 CVE-2014-3480 CVE-2014-3487 CVE-2014-3538
                 CVE-2014-3587

This update corrects DSA 3021-1, which introduced a regression in the
detection of a some "Composite Document Files" (CDF), marking

Ubuntu security update to php5
([Security] Posted Sep 10, 2014 17:09 UTC (Wed) by ris )

CVE-2014-3587)

It was discovered that the php_parserr function contains multiple buffer
overflows. An attacker could use this flaw to cause a denial of service
or possibly execute arbitrary code via crafted DNS records. (CVE-2014-3597)

Update instructions:

The problem can be corrected by updating your system

Debian security update to file
([Security] Posted Sep 9, 2014 15:48 UTC (Tue) by ris )

CVE ID         : CVE-2014-0207 CVE-2014-0237 CVE-2014-0238 CVE-2014-3478 
                 CVE-2014-3479 CVE-2014-3480 CVE-2014-3487 CVE-2014-3538
                 CVE-2014-3587

Multiple security issues have been found in file, a tool to determine 
a file type. These vulnerabilities allow remote attackers to cause

Mageia security update to php
([Security] Posted Sep 5, 2014 14:58 UTC (Fri) by n8willis )

-2014-0367 - Updated php packages fix multiple security vulnerabilities

Publication date: 05 Sep 2014
URL:  http://advisories.mageia.org/MGASA-2014-0367.html
 
Type: security
Affected Mageia releases: 3, 4
CVE: CVE-2014-3587,
     CVE-2014-3597,
     CVE-2014-5120

Description:
Updated php packages fix security vulnerabilities:

Integer overflow in the cdf_read_property_info

Mandriva security update to php
([Security] Posted Sep 3, 2014 16:27 UTC (Wed) by ris )

-2014:172
  http://www.mandriva.com/en/support/security/ 
 _______________________________________________________________________

 Package : php
 Date    : September 3, 2014
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been discovered and corrected in php:
 
 The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in
 PHP 5.4.26 and earlier, allows remote attackers to cause a denial
 of service (NULL pointer dereference and application crash) via a
 crafted color table in an XPM file (CVE-2014-2497).
 
 file before 5.19 does not properly restrict the amount of data read
 during a regex search, which allows remote attackers to cause a
 denial of service (CPU consumption) via a crafted file that triggers
 backtracking during processing of an awk rule. NOTE: this vulnerability
 exists because of an incomplete fix for CVE-2013-7345 (CVE-2014-3538).
 
 Integer overflow in the cdf_read_property_info function in cdf.c
 in file through 5.19, as used in the Fileinfo component in PHP
 before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to
 cause a denial of service (application crash) via a crafted CDF
 file. NOTE: this vulnerability exists because of an incomplete fix
 for CVE-2012-1571 (CVE-2014-3587