apachemodphp. Multiple issues were addressed by updating to PHP version 7.3.11.

A use-after-free in onignewdeluxe() in regext.c in Oniguruma 6.9.2 allows attackers to potentially cause information disclosure, denial of service, or possibly code execution by providing a crafted regular expression. The attacker provides a pair of a regex pattern and a string, with a multi-byte encoding that gets handled by onignewdeluxe(). Oniguruma issues often affect Ruby, as well as common optional libraries for PHP and Rust.

Fixed bug (Out-of-bounds read in iconv.c:phpiconvmimedecode() due to integer overflow) (CVE-2019-11039).

Fixed bug (heap-buffer-overflow on phpjpgget16) (CVE-2019-11040).

Fixed bug (Heap-buffer-overflow in estrndup via exifprocessIFDTAG) (CVE-2019-11036).

Fixed bug (Heap-buffer-overflow in exifiifaddvalue). (CVE-2019-11035)

Fixed bug (Heap-buffer-overflow in phpifdget32s). (CVE-2019-11034)

apachemodphp. This issue was addressed by updating to php version 7.1.16.

Fixed bug (Stack Buffer Overflow in msgfmtparsemessage). (CVE-2017-11362)

Fixed bug (Heap buffer overread (READ: 1) finishnesteddata from unserialize). (CVE-2017-12933)

Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)

Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)

Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)

Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)

Fixed bug (Memory corruption when loading hostile phar). (CVE-2016-10160)

Fixed bug (Use of uninitialized memory in unserialize()). (CVE-2017-5340)