USN-4166-2: PHP vulnerability
USN-4166-1 fixed a vulnerability in PHP. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that PHP incorrectly handled certain paths when being used in FastCGI configurations. A remote attacker could possibly use this issue to execute arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libapache2-mod-php5to a version that resolves this vulnerability.Fixed in 5.5.9+dfsg-1ubuntu4.29+esm6 - Upgrade
Upgrade
ubuntu/php5-fpmto a version that resolves this vulnerability.Fixed in 5.5.9+dfsg-1ubuntu4.29+esm6 - Upgrade
Upgrade
ubuntu/php5-cgito a version that resolves this vulnerability.Fixed in 5.5.9+dfsg-1ubuntu4.29+esm6 - Upgrade
Upgrade
ubuntu/php5-clito a version that resolves this vulnerability.Fixed in 5.5.9+dfsg-1ubuntu4.29+esm6 - Upgrade
Upgrade
ubuntu/libapache2-mod-php5to a version that resolves this vulnerability.Fixed in 5.3.10-1ubuntu3.40 - Upgrade
Upgrade
ubuntu/php5-fpmto a version that resolves this vulnerability.Fixed in 5.3.10-1ubuntu3.40 - Upgrade
Upgrade
ubuntu/php5-cgito a version that resolves this vulnerability.Fixed in 5.3.10-1ubuntu3.40 - Upgrade
Upgrade
ubuntu/php5-clito a version that resolves this vulnerability.Fixed in 5.3.10-1ubuntu3.40 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Patch USN-4166-1 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Patch USN-4166-2
Event History
Frequently Asked Questions
What is the vulnerability ID of this PHP vulnerability?
The vulnerability ID of this PHP vulnerability is USN-4166-2.
What is the affected software of this vulnerability?
The affected software of this vulnerability includes libapache2-mod-php5, php5-fpm, php5-cgi, and php5-cli.
What is the severity of this vulnerability?
The severity of this vulnerability is not specified in the provided information.
How can I fix this vulnerability?
To fix this vulnerability, update your Ubuntu 12.04 or 14.04 ESM system with the corresponding update provided by Ubuntu.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability at the following references: [CVE-2019-11043](https://ubuntu.com/security/CVE-2019-11043), [USN-4166-1](https://ubuntu.com/security/notices/USN-4166-1), [Launchpad](https://launchpad.net/ubuntu/+source/php5/5.5.9+dfsg-1ubuntu4.29+esm6).