Register | Log in

php5

Choose email to subscribe with

general

source: php5 (updates)
version: 5.6.40+dfsg-0+deb8u8
maintainer: Debian PHP Maintainers (archive) (DMD)
uploaders: Thijs Kinkhorst [DMD] – Lior Kaplan [DMD] – Ondřej Surý [DMD]
arch: all any
std-ver: 3.9.6
VCS: Git (Browse)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 5.6.33+dfsg-0+deb8u1
o-o-sec: 5.6.40+dfsg-0+deb8u8

versioned links

5.6.33+dfsg-0+deb8u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.6.40+dfsg-0+deb8u8: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

package is gone

This package is not in any development repository. This probably means that the package has been removed (or has been renamed). Thus the information here is of little interest ... the package is going to disappear unless someone takes it over and reintroduces it.

action needed

5 security issues in jessie high

There are 5 open security issues in jessie.

2 important issues:

CVE-2020-7060: When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause function mbfl_filt_conv_big5_wchar to read past the allocated buffer. This may lead to information disclosure or crash.
CVE-2020-7059: When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash.

3 issues skipped by the security teams:

CVE-2017-7272: PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.
TEMP-0800564-79703B:
CVE-2017-7189: main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen('127.0.0.1:80', 443) as if the address/port were 127.0.0.1:80:443, which is later truncated to 127.0.0.1:80. This behavior has a security risk if the explicitly provided port number (i.e., 443 in this example) is hardcoded into an application as a security policy, but the hostname argument (i.e., 127.0.0.1:80 in this example) is obtained from untrusted input.

Please fix them.

Created: 2015-07-12 Last update: 2020-02-21 04:50

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2020-02-18 Last update: 2020-02-26 11:04

news

[2019-12-29] Accepted php5 5.6.40+dfsg-0+deb8u8 (source amd64 all) into oldoldstable (Thorsten Alteholz)
[2019-10-26] Accepted php5 5.6.40+dfsg-0+deb8u7 (source all amd64) into oldoldstable (Sylvain Beucler)
[2019-09-20] Accepted php5 5.6.40+dfsg-0+deb8u6 (source all amd64) into oldoldstable (Roberto C. Sanchez)
[2019-08-12] Accepted php5 5.6.40+dfsg-0+deb8u5 (source all amd64) into oldoldstable (Emilio Pozuelo Monfort)
[2019-06-03] Accepted php5 5.6.40+dfsg-0+deb8u4 (source all amd64) into oldstable (Emilio Pozuelo Monfort)
[2019-05-25] Accepted php5 5.6.40+dfsg-0+deb8u3 (source amd64 all) into oldstable (Thorsten Alteholz)
[2019-03-31] Accepted php5 5.6.40+dfsg-0+deb8u2 (source amd64 all) into oldstable (Thorsten Alteholz)
[2019-02-17] Accepted php5 5.6.40+dfsg-0+deb8u1 (source all amd64) into oldstable (Roberto C. Sanchez)
[2019-02-11] Accepted php5 5.6.39+dfsg-0+deb8u2 (source amd64 all) into oldstable (Abhijith PA)
[2018-12-16] Accepted php5 5.6.39+dfsg-0+deb8u1 (source all amd64) into oldstable (Roberto C. Sanchez)
[2018-09-20] Accepted php5 5.6.38+dfsg-0+deb8u1 (source all amd64) into oldstable (Roberto C. Sanchez)
[2018-09-01] Accepted php5 5.6.37+dfsg-0+deb8u1 (source all amd64) into oldstable (Roberto C. Sanchez)
[2018-06-26] Accepted php5 5.6.36+dfsg-0+deb8u1 (source all amd64) into oldstable (Roberto C. Sanchez)
[2018-05-09] Accepted php5 5.4.45-0+deb7u14 (source amd64 all) into oldoldstable (Markus Koschany)
[2018-03-29] Accepted php5 5.4.45-0+deb7u13 (source amd64 all) into oldoldstable (Markus Koschany)
[2018-03-29] Accepted php5 5.4.45-0+deb7u13 (source amd64 all) into oldoldstable (Markus Koschany)
[2018-02-10] Accepted php5 5.6.33+dfsg-0+deb8u1 (source all amd64) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Ondřej Surý)
[2018-01-20] Accepted php5 5.4.45-0+deb7u12 (source amd64 all) into oldoldstable (Markus Koschany)
[2017-08-30] Accepted php5 5.4.45-0+deb7u11 (source amd64 all) into oldoldstable (Lucas Kanashiro)
[2017-08-26] Accepted php5 5.4.45-0+deb7u10 (source amd64 all) into oldoldstable (Lucas Kanashiro)
[2017-07-23] Accepted php5 5.4.45-0+deb7u9 (source i386 all) into oldoldstable (Markus Koschany)
[2017-03-27] Accepted php5 5.4.45-0+deb7u8 (source i386 all) into oldstable (Markus Koschany)
[2017-02-18] Accepted php5 5.6.30+dfsg-0+deb8u1 (source all amd64) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)
[2017-02-07] Accepted php5 5.4.45-0+deb7u7 (source amd64 all) into oldstable (Roberto C. Sanchez)
[2017-01-13] Removed 5.6.26+dfsg-1 from unstable (Debian FTP Masters)
[2017-01-13] Removed 5.6.26+dfsg-1 from unstable (Debian FTP Masters)
[2016-12-17] Accepted php5 5.6.29+dfsg-0+deb8u1 (source all amd64) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)
[2016-12-16] Accepted php5 5.4.45-0+deb7u6 (source amd64 all) into oldstable (Thorsten Alteholz)
[2016-12-14] Accepted php5 5.6.28+dfsg-0+deb8u1 (source all amd64) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)
[2016-10-28] Accepted php5 5.6.27+dfsg-0+deb8u1 (source all amd64) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)

1
2

bugs [bug history graph]

all: 9
RC: 1
I&N: 7
M&W: 1
F&P: 0
patch: 1

links

homepage
buildd: logs, clang, cross
popcon
edit tags
security tracker
screenshots

Debian Package Tracker — Copyright 2013-2018 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing