usn-2952-1
Vulnerability from osv_ubuntu
Published
2016-04-21 15:16
Modified
2026-04-27 14:11
Summary
php5 vulnerabilities
Details

It was discovered that the PHP Zip extension incorrectly handled directories when processing certain zip files. A remote attacker could possibly use this issue to create arbitrary directories. (CVE-2014-9767)

It was discovered that the PHP Soap client incorrectly validated data types. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-8835, CVE-2016-3185)

It was discovered that the PHP MySQL native driver incorrectly handled TLS connections to MySQL databases. A machine-in-the-middle attacker could possibly use this issue to downgrade and snoop on TLS connections. This vulnerability is known as BACKRONYM. (CVE-2015-8838)

It was discovered that PHP incorrectly handled the imagerotate function. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive information. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2016-1903)

Hans Jerry Illikainen discovered that the PHP phar extension incorrectly handled certain tar archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-2554)

It was discovered that the PHP WDDX extension incorrectly handled certain malformed XML data. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-3141)

It was discovered that the PHP phar extension incorrectly handled certain zip files. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2016-3142)

It was discovered that the PHP libxml_disable_entity_loader() setting was shared between threads. When running under PHP-FPM, this could result in XML external entity injection and entity expansion issues. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (No CVE number)

It was discovered that the PHP openssl_random_pseudo_bytes() function did not return cryptographically strong pseudo-random bytes. (No CVE number)

It was discovered that the PHP Fileinfo component incorrectly handled certain magic files. An attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE number pending)

It was discovered that the PHP php_snmp_error() function incorrectly handled string formatting. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE number pending)

It was discovered that the PHP rawurlencode() function incorrectly handled large strings. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE number pending)

It was discovered that the PHP phar extension incorrectly handled certain filenames in archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE number pending)

It was discovered that the PHP mb_strcut() function incorrectly handled string formatting. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE number pending)

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2014-9767",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2015-8835",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2015-8838",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-1903",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-2554",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-3141",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-3142",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-3185",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libapache2-mod-php5",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "libapache2-mod-php5filter",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "libphp5-embed",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php-pear",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-cgi",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-cli",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-common",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-curl",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-enchant",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-fpm",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-gd",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-gmp",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-intl",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-ldap",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-mysql",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-mysqlnd",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-odbc",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-pgsql",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-pspell",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-readline",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-recode",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-snmp",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-sqlite",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-sybase",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-tidy",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-xmlrpc",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          },
          {
            "binary_name": "php5-xsl",
            "binary_version": "5.5.9+dfsg-1ubuntu4.16"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "php5",
        "purl": "pkg:deb/ubuntu/php5@5.5.9+dfsg-1ubuntu4.16?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.5.9+dfsg-1ubuntu4.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.5.3+dfsg-1ubuntu2",
        "5.5.3+dfsg-1ubuntu3",
        "5.5.6+dfsg-1ubuntu1",
        "5.5.6+dfsg-1ubuntu2",
        "5.5.8+dfsg-2ubuntu1",
        "5.5.9+dfsg-1ubuntu1",
        "5.5.9+dfsg-1ubuntu2",
        "5.5.9+dfsg-1ubuntu3",
        "5.5.9+dfsg-1ubuntu4",
        "5.5.9+dfsg-1ubuntu4.1",
        "5.5.9+dfsg-1ubuntu4.2",
        "5.5.9+dfsg-1ubuntu4.3",
        "5.5.9+dfsg-1ubuntu4.4",
        "5.5.9+dfsg-1ubuntu4.5",
        "5.5.9+dfsg-1ubuntu4.6",
        "5.5.9+dfsg-1ubuntu4.7",
        "5.5.9+dfsg-1ubuntu4.9",
        "5.5.9+dfsg-1ubuntu4.11",
        "5.5.9+dfsg-1ubuntu4.12",
        "5.5.9+dfsg-1ubuntu4.13",
        "5.5.9+dfsg-1ubuntu4.14"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that the PHP Zip extension incorrectly handled\ndirectories when processing certain zip files. A remote attacker could\npossibly use this issue to create arbitrary directories. (CVE-2014-9767)\n\nIt was discovered that the PHP Soap client incorrectly validated data\ntypes. A remote attacker could use this issue to cause PHP to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2015-8835, CVE-2016-3185)\n\nIt was discovered that the PHP MySQL native driver incorrectly handled TLS\nconnections to MySQL databases. A machine-in-the-middle attacker could possibly\nuse this issue to downgrade and snoop on TLS connections. This\nvulnerability is known as BACKRONYM. (CVE-2015-8838)\n\nIt was discovered that PHP incorrectly handled the imagerotate function. A\nremote attacker could use this issue to cause PHP to crash, resulting in a\ndenial of service, or possibly obtain sensitive information. This issue\nonly applied to Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2016-1903)\n\nHans Jerry Illikainen discovered that the PHP phar extension incorrectly\nhandled certain tar archives. A remote attacker could use this issue to\ncause PHP to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2016-2554)\n\nIt was discovered that the PHP WDDX extension incorrectly handled certain\nmalformed XML data. A remote attacker could possibly use this issue to\ncause PHP to crash, resulting in a denial of service, or possibly execute\narbitrary code. (CVE-2016-3141)\n\nIt was discovered that the PHP phar extension incorrectly handled certain\nzip files. A remote attacker could use this issue to cause PHP to crash,\nresulting in a denial of service, or possibly obtain sensitive information.\n(CVE-2016-3142)\n\nIt was discovered that the PHP libxml_disable_entity_loader() setting was\nshared between threads. When running under PHP-FPM, this could result in\nXML external entity injection and entity expansion issues. This issue only\napplied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (No CVE number)\n\nIt was discovered that the PHP openssl_random_pseudo_bytes() function did\nnot return cryptographically strong pseudo-random bytes. (No CVE number)\n\nIt was discovered that the PHP Fileinfo component incorrectly handled\ncertain magic files. An attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE number pending)\n\nIt was discovered that the PHP php_snmp_error() function incorrectly\nhandled string formatting. A remote attacker could use this issue to cause\nPHP to crash, resulting in a denial of service, or possibly execute\narbitrary code. This issue only applied to Ubuntu 14.04 LTS and Ubuntu\n15.10. (CVE number pending)\n\nIt was discovered that the PHP rawurlencode() function incorrectly handled\nlarge strings. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service. (CVE number pending)\n\nIt was discovered that the PHP phar extension incorrectly handled certain\nfilenames in archives. A remote attacker could use this issue to cause PHP\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE number pending)\n\nIt was discovered that the PHP mb_strcut() function incorrectly handled\nstring formatting. A remote attacker could use this issue to cause PHP to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE number pending)\n",
  "id": "USN-2952-1",
  "modified": "2026-04-27T14:11:22Z",
  "published": "2016-04-21T15:16:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2952-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-9767"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2015-8835"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2015-8838"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-1903"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-2554"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-3141"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-3142"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-3185"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "php5 vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2014-9767",
    "UBUNTU-CVE-2015-8835",
    "UBUNTU-CVE-2015-8838",
    "UBUNTU-CVE-2016-1903",
    "UBUNTU-CVE-2016-2554",
    "UBUNTU-CVE-2016-3141",
    "UBUNTU-CVE-2016-3142",
    "UBUNTU-CVE-2016-3185"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.