Register | Log in

php5

Choose email to subscribe with

general

source: php5 (main)
version: 5.6.33+dfsg-0+deb8u1
maintainer: Debian PHP Maintainers (archive) [DMD]
uploaders: Thijs Kinkhorst [DMD] – Lior Kaplan [DMD] – Ondřej Surý [DMD]
arch: all any
std-ver: 3.9.6
VCS: Git (Browse)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 5.4.45-0+deb7u2
o-o-sec: 5.4.45-0+deb7u14
oldstable: 5.6.33+dfsg-0+deb8u1
old-sec: 5.6.33+dfsg-0+deb8u1

versioned links

5.4.45-0+deb7u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.4.45-0+deb7u14: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.6.33+dfsg-0+deb8u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

package is gone

This package is not in any development repository. This probably means that the package has been removed (or has been renamed). Thus the information here is of little interest ... the package is going to disappear unless someone takes it over and reintroduces it.

action needed

8 security issues in jessie high

There are 8 open security issues in jessie.

6 important issues:

CVE-2018-7584: In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string.
CVE-2018-10548: An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. ext/ldap/ldap.c allows remote LDAP servers to cause a denial of service (NULL pointer dereference and application crash) because of mishandling of the ldap_get_dn return value.
CVE-2018-10549: An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. exif_read_data in ext/exif/exif.c has an out-of-bounds read for crafted JPEG data because exif_iif_add_value mishandles the case of a MakerNote that lacks a final '\0' character.
CVE-2018-10546: An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infinite loop exists in ext/iconv/iconv.c because the iconv stream filter does not reject invalid multibyte sequences.
CVE-2018-10547: An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-5712.
CVE-2018-10545: An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call, allowing one user (in a multiuser environment) to obtain sensitive information from the process memory of a second user's PHP applications by running gcore on the PID of the PHP-FPM worker process.

2 issues skipped by the security teams:

TEMP-0800564-79703B:
CVE-2017-7272: PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.

Please fix them.

Created: 2015-07-12 Last update: 2018-06-23 14:22

Standards version of the package is outdated. high

The package is severely out of date with respect to the Debian Policy. The package should be updated to follow the last version of Debian Policy (Standards-Version 4.1.4 instead of 3.9.6).

Created: 2016-02-25 Last update: 2018-05-10 02:03

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2018-02-12 Last update: 2018-06-23 13:58

news

[2018-05-09] Accepted php5 5.4.45-0+deb7u14 (source amd64 all) into oldoldstable (Markus Koschany)
[2018-03-29] Accepted php5 5.4.45-0+deb7u13 (source amd64 all) into oldoldstable (Markus Koschany)
[2018-03-29] Accepted php5 5.4.45-0+deb7u13 (source amd64 all) into oldoldstable (Markus Koschany)
[2018-02-10] Accepted php5 5.6.33+dfsg-0+deb8u1 (source all amd64) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Ondřej Surý)
[2018-01-20] Accepted php5 5.4.45-0+deb7u12 (source amd64 all) into oldoldstable (Markus Koschany)
[2017-08-30] Accepted php5 5.4.45-0+deb7u11 (source amd64 all) into oldoldstable (Lucas Kanashiro)
[2017-08-26] Accepted php5 5.4.45-0+deb7u10 (source amd64 all) into oldoldstable (Lucas Kanashiro)
[2017-07-23] Accepted php5 5.4.45-0+deb7u9 (source i386 all) into oldoldstable (Markus Koschany)
[2017-03-27] Accepted php5 5.4.45-0+deb7u8 (source i386 all) into oldstable (Markus Koschany)
[2017-02-18] Accepted php5 5.6.30+dfsg-0+deb8u1 (source all amd64) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)
[2017-02-07] Accepted php5 5.4.45-0+deb7u7 (source amd64 all) into oldstable (Roberto C. Sanchez)
[2017-01-13] Removed 5.6.26+dfsg-1 from unstable (Debian FTP Masters)
[2017-01-13] Removed 5.6.26+dfsg-1 from unstable (Debian FTP Masters)
[2016-12-17] Accepted php5 5.6.29+dfsg-0+deb8u1 (source all amd64) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)
[2016-12-16] Accepted php5 5.4.45-0+deb7u6 (source amd64 all) into oldstable (Thorsten Alteholz)
[2016-12-14] Accepted php5 5.6.28+dfsg-0+deb8u1 (source all amd64) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)
[2016-10-28] Accepted php5 5.6.27+dfsg-0+deb8u1 (source all amd64) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)
[2016-10-28] Accepted php5 5.6.26+dfsg-0+deb8u1 (source all amd64) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)
[2016-09-18] Accepted php5 5.4.45-0+deb7u5 (source amd64 all) into oldstable (Thorsten Alteholz)
[2016-09-18] Accepted php5 5.6.26+dfsg-1 (source amd64 all) into unstable (Ondřej Surý)
[2016-07-30] Accepted php5 5.6.24+dfsg-0+deb8u1 (source all amd64) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)
[2016-07-26] Accepted php5 5.6.24+dfsg-1 (source amd64 all) into unstable (Ondřej Surý)
[2016-07-16] Accepted php5 5.6.23+dfsg-0+deb8u1 (source all amd64) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)
[2016-07-01] php5 REMOVED from testing (Debian testing watch)
[2016-06-29] Accepted php5 5.4.45-0+deb7u4 (source i386 all) into oldstable (signed by: Thorsten Alteholz)
[2016-06-24] Accepted php5 5.6.23+dfsg-1 (source amd64 all) into unstable (Ondřej Surý)
[2016-06-21] php5 5.6.22+dfsg-2 MIGRATED to testing (Debian testing watch)
[2016-06-17] Accepted php5 5.6.22+dfsg-0+deb8u1 (source all amd64) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)
[2016-06-16] Accepted php5 5.6.22+dfsg-2 (source) into unstable (Ondřej Surý)
[2016-06-01] php5 5.6.22+dfsg-1 MIGRATED to testing (Debian testing watch)

1
2

bugs [bug history graph]

all: 8
RC: 0
I&N: 7
M&W: 1
F&P: 0

links

homepage
buildd: logs, clang
popcon
browse source code
edit tags
security tracker
screenshots

Debian Package Tracker — Copyright 2013-2018 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing