Post Now

Warning ! Multiple Severe Vulnerabilities Discovered in PHP

Image

Centre of Internet Security has released an advisory(2018-046) regarding Multiple severe vulnerabilities discovered in PHP which could allow attackers to gain control of the system.

Centre of Internet Security has released an advisory(2018-046) regarding Multiple severe vulnerabilities discovered in PHP which could allow attackers to gain control of the system.By successfully exploiting these vulnerabilities, attackers can execute an arbitrary code, install programs, view, change, or delete data, or create new accounts with full user rights depending upon privileges with the application and failed exploitation could lead to the denial-of-service condition.Systems which are affected by the vulnerabilities are:

  • PHP 7.2 prior to 7.2.5
  • PHP 7.1 prior to 7.1.17
  • PHP 7.0 prior to 7.0.30
  • PHP 5.0 prior to 5.6.36
According to Centre of Internet Security, the details of the vulnerabilities are given below:Version 7.2.5
  • Bug #75722 (Convert valgrind detection to configure option).
  • Bug #76131 (mismatch arginfo for date_create).
  • Bug #76130 (Heap Buffer Overflow (READ: 1786) in exif_iif_add_value).
  • Bug #68440 (ERROR: failed to reload: execvp() failed: Argument list too long).
  • Fixed incorrect write to getenv result in FPM reload.
  • Bug #52070 (imagedashedline() - dashed line sometimes is not visible).
  • Bug #76249 (stream filter convert.iconv leads to infinite loop on invalid sequence).
  • Bug #76153 (Intl compilation fails with icu4c 61.1).
  • Bug #76248 (Malicious LDAP-Server Response causes Crash).
  • Bug #75944 (Wrong cp1251 detection).
  • Bug #76113 (mbstring does not build with Oniguruma 6.8.1).
  • Bug #76088 (ODBC functions are not available by default on Windows).
  • Bug #76094 (Access violation when using opcache).
  • Bug #76129 (fix for CVE-2018-5712 may not be complete).
  • Bug #76143 (Memory corruption: arbitrary NUL overwrite).
  • Bug #76131 (mismatch arginfo for splarray constructor).
  • Bug #74139 (mail.add_x_header default inconsistent with docs).
  • Bug #75996 (incorrect url in header for mt_rand).
Version 7.1.17
  • Bug #76131 (mismatch arginfo for date_create).
  • Bug#76130 (Heap Buffer Overflow (READ: 1786) in exif_iif_add_value).
  • Bug #68440 (ERROR: failed to reload: execvp() failed: Argument list too long).
  • Fixed incorrect write to getenv result in FPM reload.
  • Bug #52070 (imagedashedline() - dashed line sometimes is not visible).
  • Bug #76249 (stream filter convert.iconv leads to infinite loop on invalid sequence).
  • Bug #76153 (Intl compilation fails with icu4c 61.1).
  • Bug #76248 (Malicious LDAP-Server Response causes Crash).
  • Bug #75944 (Wrong cp1251 detection).
  • Bug #76113 (mbstring does not build with Oniguruma 6.8.1).
  • Bug #76129 (fix for CVE-2018-5712 may not be complete).
  • Bug #76143 (Memory corruption: arbitrary NUL overwrite).
  • Bug #76131 (mismatch arginfo for splarray constructor).
  • Bug #75996 (incorrect url in header for mt_rand).
Version 7.0.30
  • Bug #76130 (Heap Buffer Overflow (READ: 1786) in exif_iif_add_value).
  • Bug #76249 (stream filter convert.iconv leads to infinite loop on invalid sequence).
  • Bug #76248 (Malicious LDAP-Server Response causes Crash).
  • Bug #76129 (fix for CVE-2018-5712 may not be complete).
Version 5.6.36
  • Bug #76130 (Heap Buffer Overflow (READ: 1786) in exif_iif_add_value).
  • Bug #76249 (stream filter convert.iconv leads to infinite loop on invalid sequence).
  • Bug #76248 (Malicious LDAP-Server Response causes Crash).
  • Bug #76129 (fix for CVE-2018-5712 may not be complete).
United States Computer Emergency Readiness Team has also published an advisory regarding multiple vulnerabilities discovered in Hypertext Preprocessor (PHP). The vulnerabilities could affect all large and small government and business organizations.Users are advised to immediately upgrade to the latest version of PHP after appropriate testing and has to make sure that there are no unauthorized system modifications before applying the patches.Users also should avoid clicking or visiting any unknown websites or download any files or attachment from unknown emails.