apachemodphp. Multiple issues were addressed by updating to PHP version 7.3.11.
A use-after-free in onignewdeluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onignewdeluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.
Fixed bug (Out-of-bounds read in iconv.c:phpiconvmimedecode() due to integer overflow) (CVE-2019-11039).
Fixed bug (heap-buffer-overflow on phpjpgget16) (CVE-2019-11040).
Fixed bug (Heap-buffer-overflow in estrndup via exifprocessIFDTAG) (CVE-2019-11036).
Fixed bug (Heap-buffer-overflow in exifiifaddvalue). (CVE-2019-11035)
Fixed bug (Heap-buffer-overflow in phpifdget32s). (CVE-2019-11034)
apachemodphp. This issue was addressed by updating to php version 7.1.16.
ext/standard/varunserializer.re in PHP 7.0.x through 7.0.22 and 7.1.x through 7.1.8 is prone to a heap use after free while unserializing untrusted data, related to improper use of the hash API for key deletion in a situation with an invalid array size. Exploitation of this issue can have an unspecified impact on the integrity of PHP.
Upstream patch:
https://github.com/php/php-src/commit/1a23ebc1fff59bf480ca92963b36eba5c1b904c4
Upstream bug:
https://bugs.php.net/bug.php?id=74103
Fixed bug (Stack Buffer Overflow in msgfmtparsemessage). (CVE-2017-11362)
Fixed bug (Heap buffer overread (READ: 1) finishnesteddata from unserialize). (CVE-2017-12933)
Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)
Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)
Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)
Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)
Fixed bug (Seg fault when loading hostile phar). (CVE-2017-11147)
Fixed bug (Memory corruption when loading hostile phar). (CVE-2016-10160)
Fixed bug (Unserialize use-after-free when resizing object's properties hash table). (CVE-2016-7479)
Fixed bug (Use of uninitialized memory in unserialize()). (CVE-2017-5340)
ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxmldisableentityloader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.
Fixed bug (applied upstream patch for CVE-2016-1283).