Debian Package Tracker

general

source: php7.0 (main)
version: 7.0.29-1
maintainer: Debian PHP Maintainers (archive) [DMD]
uploaders: Lior Kaplan [DMD] – Ondřej Surý [DMD]
arch: all any
std-ver: 3.9.7
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

stable: 7.0.27-0+deb9u1
stable-sec: 7.0.27-0+deb9u1
testing: 7.0.29-1
unstable: 7.0.29-1

versioned links

7.0.14-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.0.27-0+deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.0.29-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libapache2-mod-php7.0
libphp7.0-embed
php7.0
php7.0-bcmath
php7.0-bz2
php7.0-cgi
php7.0-cli
php7.0-common
php7.0-curl
php7.0-dba
php7.0-dev
php7.0-enchant
php7.0-fpm
php7.0-gd
php7.0-gmp
php7.0-imap
php7.0-interbase
php7.0-intl
php7.0-json
php7.0-ldap
php7.0-mbstring
php7.0-mcrypt
php7.0-mysql
php7.0-odbc
php7.0-opcache
php7.0-pgsql
php7.0-phpdbg
php7.0-pspell
php7.0-readline
php7.0-recode
php7.0-snmp
php7.0-soap
php7.0-sqlite3
php7.0-sybase
php7.0-tidy
php7.0-xml
php7.0-xmlrpc
php7.0-xsl
php7.0-zip

action needed

Standards version of the package is outdated. high

The package is severely out of date with respect to the Debian Policy. The package should be updated to follow the last version of Debian Policy (Standards-Version 4.1.4 instead of 3.9.7).

Created: 2016-04-15 Last update: 2018-04-16 20:54

3 security issues in stretch high

There are 3 open security issues in stretch.

1 important issue:

CVE-2018-7584: In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string.

2 issues skipped by the security teams:

CVE-2017-8923: The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.
CVE-2017-7272: PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.

Please fix them.

Created: 2017-03-28 Last update: 2018-04-13 08:05

2 security issues in buster high

There are 2 open security issues in buster.

2 important issues:

CVE-2017-8923: The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.
CVE-2017-7272: PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.

Please fix them.

Created: 2017-06-18 Last update: 2018-04-13 08:05

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2017-8923: The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.
CVE-2017-7272: PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.

Please fix them.

Created: 2017-05-13 Last update: 2018-04-13 08:05

lintian reports 6 errors and 17 warnings high

Lintian reports 6 errors and 17 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2018-04-11 Last update: 2018-04-11 06:17

Error while accessing the VCS repository. Please troubleshot and fix the issue. high

vcswatch reports that there is an error with this package's VCS, or the debian/changelog file inside it. Please check the error shown below and try to fix it. You might have to update the VCS URL in the debian/control file to point to the correct repository.

changelog package php7.1 does not match source php7.0

Created: 2017-12-03 Last update: 2018-03-06 20:03

Build log checks report 1 error high

Build log checks report 1 error

Created: 2017-10-26 Last update: 2018-03-06 19:50

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2016-04-06 Last update: 2018-04-24 02:25

Depends on packages which need a new maintainer normal

The packages that php7.0 depends on which need a new maintainer are:

qdbm (#890504)
- Build-Depends: libqdbm-dev
- Depends: libqdbm14
shtool (#837052)
- Depends: shtool

Created: 2017-12-02 Last update: 2018-04-24 02:16

3 bugs tagged patch in the BTS normal

The BTS contains patches fixing 3 bugs, consider including or untagging them.

Created: 2017-11-21 Last update: 2018-04-24 01:48

testing migrations

This package will soon be part of the auto-libzip transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the curl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the libncurses6 transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-icu transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-enchant transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2018-04-13] php7.0 7.0.29-1 MIGRATED to testing (Debian testing watch)
[2018-04-05] Accepted php7.0 7.0.29-1 (source) into unstable (Ondřej Surý)
[2018-03-11] php7.0 7.0.28-1 MIGRATED to testing (Debian testing watch)
[2018-03-06] Accepted php7.0 7.0.28-1 (source) into unstable (Ondřej Surý)
[2018-02-09] Accepted php7.0 7.0.27-0+deb9u1 (source) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)
[2018-01-10] php7.0 7.0.27-1 MIGRATED to testing (Debian testing watch)
[2018-01-05] Accepted php7.0 7.0.27-1 (source) into unstable (Ondřej Surý)
[2017-12-04] php7.0 7.0.26-1 MIGRATED to testing (Debian testing watch)
[2017-11-29] Accepted php7.0 7.0.26-1 (source) into unstable (Ondřej Surý)
[2017-11-17] php7.0 7.0.25-1 MIGRATED to testing (Debian testing watch)
[2017-11-12] Accepted php7.0 7.0.25-1 (source) into unstable (Ondřej Surý)
[2017-08-28] php7.0 7.0.22-3 MIGRATED to testing (Debian testing watch)
[2017-08-23] Accepted php7.0 7.0.22-3 (source) into unstable (Ondřej Surý)
[2017-08-09] php7.0 7.0.22-2 MIGRATED to testing (Debian testing watch)
[2017-08-04] Accepted php7.0 7.0.22-2 (source) into unstable (Ondřej Surý)
[2017-08-04] Accepted php7.0 7.0.22-1 (source amd64 all) into unstable (Ondřej Surý)
[2017-06-20] php7.0 7.0.20-2 MIGRATED to testing (Debian testing watch)
[2017-06-14] Accepted php7.0 7.0.20-2 (source) into unstable (Ondřej Surý)
[2017-06-09] Accepted php7.0 7.0.20-1 (source) into unstable (Ondřej Surý)
[2017-05-22] php7.0 7.0.19-1 MIGRATED to testing (Debian testing watch)
[2017-05-11] Accepted php7.0 7.0.19-1 (source) into unstable (Ondřej Surý)
[2017-05-08] Accepted php7.0 7.0.18-3 (source) into unstable (Ondřej Surý)
[2017-04-23] Accepted php7.0 7.0.18-2 (source) into unstable (Ondřej Surý)
[2017-04-18] Accepted php7.0 7.0.18-1 (source) into unstable (Ondřej Surý)
[2017-03-05] php7.0 7.0.16-3 MIGRATED to testing (Debian testing watch)
[2017-02-22] Accepted php7.0 7.0.16-3 (source amd64 all) into unstable (Ondřej Surý)
[2017-02-19] Accepted php7.0 7.0.16-2 (source amd64 all) into unstable (Ondřej Surý)
[2017-02-05] php7.0 7.0.15-1 MIGRATED to testing (Debian testing watch)
[2017-01-25] Accepted php7.0 7.0.15-1 (source) into unstable (Ondřej Surý)
[2016-12-24] php7.0 7.0.14-2 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 23
RC: 0
I&N: 18
M&W: 5
F&P: 0

links

homepage
lintian (6, 17)
buildd: logs, checks, clang, reproducibility
popcon
debci
browse source code
edit tags
security tracker
screenshots