Debian Package Tracker

general

source: php7.0 (main)
version: 7.0.31-1
maintainer: Debian PHP Maintainers [DMD]
uploaders: Lior Kaplan [DMD] – Ondřej Surý [DMD]
arch: all any
std-ver: 3.9.7
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

stable: 7.0.30-0+deb9u1
stable-sec: 7.0.30-0+deb9u1
testing: 7.0.31-1
unstable: 7.0.31-1

versioned links

7.0.14-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.0.30-0+deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.0.31-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libapache2-mod-php7.0
libphp7.0-embed
php7.0
php7.0-bcmath
php7.0-bz2
php7.0-cgi
php7.0-cli
php7.0-common
php7.0-curl
php7.0-dba
php7.0-dev
php7.0-enchant
php7.0-fpm
php7.0-gd
php7.0-gmp
php7.0-imap
php7.0-interbase
php7.0-intl
php7.0-json
php7.0-ldap
php7.0-mbstring
php7.0-mcrypt
php7.0-mysql
php7.0-odbc
php7.0-opcache
php7.0-pgsql
php7.0-phpdbg
php7.0-pspell
php7.0-readline
php7.0-recode
php7.0-snmp
php7.0-soap
php7.0-sqlite3
php7.0-sybase
php7.0-tidy
php7.0-xml
php7.0-xmlrpc
php7.0-xsl
php7.0-zip

action needed

A new upstream version is available: 7.0.32 high

A new upstream version 7.0.32 is available, you should consider packaging it.

Created: 2018-09-17 Last update: 2018-09-21 10:18

Failed to analyze the VCS repository. Please troubleshoot and fix the issue. high

vcswatch reports that there is an error with this package's VCS, or the debian/changelog file inside it. Please check the error shown below and try to fix it. You might have to update the VCS URL in the debian/control file to point to the correct repository.

changelog package php7.2 does not match source php7.0

Created: 2017-12-03 Last update: 2018-09-21 09:40

5 security issues in buster high

There are 5 open security issues in buster.

5 important issues:

CVE-2017-8923: The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.
CVE-2017-9118: PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
CVE-2017-9120: PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a long string because of an Integer overflow in mysqli_real_escape_string.
CVE-2017-7272: PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.
CVE-2018-17082: The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.

Please fix them.

Created: 2018-08-03 Last update: 2018-09-18 08:17

5 security issues in sid high

There are 5 open security issues in sid.

5 important issues:

CVE-2017-8923: The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.
CVE-2017-9118: PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
CVE-2017-9120: PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a long string because of an Integer overflow in mysqli_real_escape_string.
CVE-2017-7272: PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.
CVE-2018-17082: The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.

Please fix them.

Created: 2017-05-13 Last update: 2018-09-18 08:17

7 security issues in stretch high

There are 7 open security issues in stretch.

5 important issues:

CVE-2017-9118: PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
CVE-2018-14851: exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG file.
CVE-2017-9120: PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a long string because of an Integer overflow in mysqli_real_escape_string.
CVE-2018-17082: The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.
CVE-2018-14883: An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. An Integer Overflow leads to a heap-based buffer over-read in exif_thumbnail_extract of exif.c.

2 issues skipped by the security teams:

CVE-2017-8923: The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.
CVE-2017-7272: PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.

Please fix them.

Created: 2017-03-28 Last update: 2018-09-18 08:17

Standards version of the package is outdated. high

The package is severely out of date with respect to the Debian Policy. The package should be updated to follow the last version of Debian Policy (Standards-Version 4.2.1 instead of 3.9.7).

Created: 2016-04-15 Last update: 2018-08-26 08:17

lintian reports 6 errors and 17 warnings high

Lintian reports 6 errors and 17 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2018-04-11 Last update: 2018-05-21 07:50

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2018-09-11 Last update: 2018-09-21 13:23

3 bugs tagged patch in the BTS normal

The BTS contains patches fixing 3 bugs, consider including or untagging them.

Created: 2017-11-21 Last update: 2018-09-21 13:12

Depends on packages which need a new maintainer normal

The packages that php7.0 depends on which need a new maintainer are:

qdbm (#890504)
- Depends: libqdbm14
- Build-Depends: libqdbm-dev
shtool (#837052)
- Depends: shtool

Created: 2017-12-02 Last update: 2018-09-21 12:46

testing migrations

This package will soon be part of the auto-enchant transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-icu transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-libzip transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2018-08-06] php7.0 7.0.31-1 MIGRATED to testing (Debian testing watch)
[2018-08-04] php7.0 7.0.30-2 MIGRATED to testing (Debian testing watch)
[2018-08-04] Accepted php7.0 7.0.31-1 (source) into unstable (Lior Kaplan)
[2018-07-11] Accepted php7.0 7.0.30-2 (source) into unstable (Ondřej Surý)
[2018-07-11] Accepted php7.0 7.0.30-1 (source) into unstable (Ondřej Surý)
[2018-07-06] Accepted php7.0 7.0.30-0+deb9u1 (source amd64 all) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)
[2018-07-05] Accepted php7.0 7.0.30-0+deb9u1 (source amd64 all) into stable->embargoed, stable (Ondřej Surý)
[2018-06-02] php7.0 REMOVED from testing (Debian testing watch)
[2018-04-13] php7.0 7.0.29-1 MIGRATED to testing (Debian testing watch)
[2018-04-05] Accepted php7.0 7.0.29-1 (source) into unstable (Ondřej Surý)
[2018-03-11] php7.0 7.0.28-1 MIGRATED to testing (Debian testing watch)
[2018-03-06] Accepted php7.0 7.0.28-1 (source) into unstable (Ondřej Surý)
[2018-02-09] Accepted php7.0 7.0.27-0+deb9u1 (source) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)
[2018-01-10] php7.0 7.0.27-1 MIGRATED to testing (Debian testing watch)
[2018-01-05] Accepted php7.0 7.0.27-1 (source) into unstable (Ondřej Surý)
[2017-12-04] php7.0 7.0.26-1 MIGRATED to testing (Debian testing watch)
[2017-11-29] Accepted php7.0 7.0.26-1 (source) into unstable (Ondřej Surý)
[2017-11-17] php7.0 7.0.25-1 MIGRATED to testing (Debian testing watch)
[2017-11-12] Accepted php7.0 7.0.25-1 (source) into unstable (Ondřej Surý)
[2017-08-28] php7.0 7.0.22-3 MIGRATED to testing (Debian testing watch)
[2017-08-23] Accepted php7.0 7.0.22-3 (source) into unstable (Ondřej Surý)
[2017-08-09] php7.0 7.0.22-2 MIGRATED to testing (Debian testing watch)
[2017-08-04] Accepted php7.0 7.0.22-2 (source) into unstable (Ondřej Surý)
[2017-08-04] Accepted php7.0 7.0.22-1 (source amd64 all) into unstable (Ondřej Surý)
[2017-06-20] php7.0 7.0.20-2 MIGRATED to testing (Debian testing watch)
[2017-06-14] Accepted php7.0 7.0.20-2 (source) into unstable (Ondřej Surý)
[2017-06-09] Accepted php7.0 7.0.20-1 (source) into unstable (Ondřej Surý)
[2017-05-22] php7.0 7.0.19-1 MIGRATED to testing (Debian testing watch)
[2017-05-11] Accepted php7.0 7.0.19-1 (source) into unstable (Ondřej Surý)
[2017-05-08] Accepted php7.0 7.0.18-3 (source) into unstable (Ondřej Surý)

bugs [bug history graph]

all: 31
RC: 0
I&N: 23
M&W: 5
F&P: 0
patch: 3

links

homepage
lintian (6, 17)
buildd: logs, checks, clang, reproducibility
popcon
debci
browse source code
edit tags
security tracker
screenshots