DSA-4353: -1 php7.0 -- security update
Multiple security issues were found in PHP, a widely-used open source general purpose scripting language: The EXIF module was susceptible to denial of service/information disclosure when parsing malformed images, the Apache module allowed cross-site-scripting via the body of a "Transfer-Encoding: chunked" request and the IMAP extension performed insufficient input validation which can result in the execution of arbitrary shell commands in the imapopen() function and denial of service in the imapmail() function.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
php7.0to a version that resolves this vulnerability.Patch DSA-4353-1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which application features should be prioritized for review?
Prioritize applications that parse untrusted image files through PHP’s EXIF module, accept HTTP requests through the PHP Apache module, or use the IMAP extension’s imap_open() or imap_mail() functions.
What security impacts are associated with the affected components?
Malformed image parsing in EXIF can cause denial of service or information disclosure. The Apache module issue can enable cross-site scripting through the body of a chunked request, while IMAP extension issues can lead to arbitrary shell command execution in imap_open() and denial of service in imap_mail().
Is a default configuration known to be affected?
The available information does not state whether default PHP configurations enable the affected EXIF, Apache, or IMAP functionality. Exposure depends on whether the relevant module or extension is installed and used.