UbuntuUpdates.org

Package "php7.3"

Name: php7.3

Description:

server-side, HTML-embedded scripting language (metapackage)

Latest version: 7.3.11-0ubuntu0.19.10.6
Release: eoan (19.10)
Level: security
Repository: main
Homepage: http://www.php.net/

Links


Download "php7.3"


Other versions of "php7.3" in Eoan

Repository Area Version
base main 7.3.8-1
security universe 7.3.11-0ubuntu0.19.10.6
updates main 7.3.11-0ubuntu0.19.10.6
updates universe 7.3.11-0ubuntu0.19.10.6

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 7.3.11-0ubuntu0.19.10.6 2020-05-27 20:06:54 UTC

  php7.3 (7.3.11-0ubuntu0.19.10.6) eoan-security; urgency=medium

  * SECURITY UPDATE: Denial of service through oversized memory allocated
    - debian/patches/CVE-2019-11048.patch: changes types int to size_t
      in main/rfc1867.c.
    - CVE-2019-11048

 -- <email address hidden> (Leonidas S. Barbosa) Tue, 26 May 2020 09:28:47 -0300

Source diff to previous version
CVE-2019-11048 In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or

Version: 7.3.11-0ubuntu0.19.10.4 2020-04-15 16:07:07 UTC

  php7.3 (7.3.11-0ubuntu0.19.10.4) eoan-security; urgency=medium

  * SECURITY UDPATE: Null dereference pointer
    - debian/patches/CVE-2020-7062.patch: avoid null dereference in
      ext/session/session.c.
    - CVE-2020-7062
  * SECURITY UPDATE: Lax permissions on files added to tar with Phar
    - debian/patches/CVE-2020-7063.patch: enforce correct permissions
      for files add to tar with Phar in ext/phar/phar_object.c,
      ext/phar/tests/bug79082.phpt, ext/phar/tests/test79082*.
    - CVE-2020-7063
  * SECURITY UPDATE: Read one byte of uninitialized memory
    - debian/patches/CVE-2020-7064.patch: check length in
      exif_process_TIFF_in_JPEG to avoid read uninitialized memory
      ext/exif/exif.c, ext/exif/tests/bug79282.phpt.
    - CVE-2020-7064
  * SECURITY UPDATE: Memory corruption, crash and potentially code execution
    - debian/patches/CVE-2020-7065.patch: make sure that negative values are
      properly compared in ext/mbstring/php_unicode.c,
      ext/mbstring/tests/bug70371.phpt.
    - CVE-2020-7065
  * SECURITY UPDATE: Truncated url due \0
    - debian/patches/CVE-2020-7066.patch: check for get_headers
      not accepting \0 in ext/standard/url.c.
    - CVE-2020-7066

 -- <email address hidden> (Leonidas S. Barbosa) Wed, 08 Apr 2020 15:58:29 -0300

Source diff to previous version
CVE-2020-7062 In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is en
CVE-2020-7063 In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function
CVE-2020-7064 In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while parsing EXIF data with exif_read_data() function, it is possible
CVE-2020-7065 In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could
CVE-2020-7066 In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while using get_headers() with user-supplied URL, if the URL contains z

Version: 7.3.11-0ubuntu0.19.10.3 2020-02-17 21:06:42 UTC

  php7.3 (7.3.11-0ubuntu0.19.10.3) eoan-security; urgency=medium

  * SECURITY UPDATE: Out of bounds read, buffer overflow and
    heap use-after-free
    - debian/patches/CVE-2020-7059-and-CVE-2020-7060.patch:
      fix OOB read in php_strip_tags_ex in ext/standard/string.c
      and added test ext/standard/tests/file/bug79099.phpt,
      fix adding a check function
      is_in_cp950_pua in ext/mbstring/libmbfl/filters/mbfilter_big5.c
      and added test ext/mbstring/tests/bug79037.phpt,
      fix use-after-free in session_create_id() and
      added tests ext/session/tests/bug79091.phpt.
    - CVE-2020-7059
    - CVE-2020-7060

 -- <email address hidden> (Leonidas S. Barbosa) Wed, 12 Feb 2020 12:22:33 -0300

Source diff to previous version
CVE-2020-7059 When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is pos
CVE-2020-7060 When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it

Version: 7.3.11-0ubuntu0.19.10.2 2020-01-15 14:07:15 UTC

  php7.3 (7.3.11-0ubuntu0.19.10.2) eoan-security; urgency=medium

  * SECURITY UPDATE: silently truncates
    a class after a null byte
    - debian/patches/CVE-2019-11045.patch: not accept
      arbitrary strings in ext/spl/spl_directory.c,
      ext/spl/tests/bug78863.phpt.
    - CVE-2019-11045
  * SECURITY UPDATE: Buffer underflow
    - debian/patches/CVE-2019-11046.patch: not rely on `isdigit()`
      to detect digits in ext/bcmath/libbcmath/src/str2num.c,
      ext/bcmath/tests/bug78878.phpt.
    - CVE-2019-11046
  * SECURITY UPDATE: Heap-buffer-overflow
    - debian/patches/CVE-2019-11047.patch: fix in ext/exif/exif.c,
      ext/exif/tests/bug78910.phpt.
    - CVE-2019-11047
  * SECURITY UPDATE: Use-after-free
    - debian/patches/CVE-2019-11050.patch: fix in
      ext/exif/exif.c, ext/exif/tests/bug78793.phpt.
    - CVE-2019-11050
  * Fixing tests bug54291 and bug78878
    - debian/patches/Fixing-test-bug54291.patch: fix in
      ext/spl/tests/bug54291.phpt.
    - debian/patches/Fixing-test-78878.patch: fix in
      ext/bcmath/tests/bug78878.phpt

 -- <email address hidden> (Leonidas S. Barbosa) Tue, 14 Jan 2020 12:33:46 -0300

Source diff to previous version
CVE-2019-11045 In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them
CVE-2019-11046 In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked i
CVE-2019-11047 When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x belo
CVE-2019-11050 When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x belo

Version: 7.3.11-0ubuntu0.19.10.1 2019-10-28 18:07:03 UTC

  php7.3 (7.3.11-0ubuntu0.19.10.1) eoan-security; urgency=medium

  * SECURITY UPDATE: updated to 7.3.11 to fix security issue
    - CVE-2019-11043
  * Refreshed patches.
  * debian/rules: temporarily disable setting up MySQL for the tests as the
    setup script isn't compatible with MySQL 8.0 and the MySQL tests didn't
    seem to run anyway.

 -- Marc Deslauriers <email address hidden> Thu, 24 Oct 2019 07:38:49 -0400




About   -   Send Feedback to @ubuntu_updates