Register | Log in

php7.0

Choose email to subscribe with

general

source: php7.0 (updates)
version: 7.0.33-0+deb9u3
maintainer: Debian PHP Maintainers (archive) (DMD)
uploaders: Lior Kaplan [DMD] – Ondřej Surý [DMD]
arch: all any
std-ver: 3.9.7
VCS: Git (Browse)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

stable: 7.0.33-0+deb9u3
stable-sec: 7.0.33-0+deb9u3

versioned links

7.0.33-0+deb9u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

package is gone

This package is not in any development repository. This probably means that the package has been removed (or has been renamed). Thus the information here is of little interest ... the package is going to disappear unless someone takes it over and reintroduces it.

action needed

10 security issues in stretch high

There are 10 open security issues in stretch.

4 important issues:

CVE-2019-11041: When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
CVE-2019-11040: When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
CVE-2019-11042: When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and 7.3.x below 7.3.8 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.
CVE-2019-11039: Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.

6 issues skipped by the security teams:

CVE-2019-11036: When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.
CVE-2017-7189: main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen('127.0.0.1:80', 443) as if the address/port were 127.0.0.1:80:443, which is later truncated to 127.0.0.1:80. This behavior has a security risk if the explicitly provided port number (i.e., 443 in this example) is hardcoded into an application as a security policy, but the hostname argument (i.e., 127.0.0.1:80 in this example) is obtained from untrusted input.
CVE-2017-7272: PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.
CVE-2019-11035: When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.
CVE-2019-11034: When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.
CVE-2017-8923: The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.

Please fix them.

Created: 2017-03-28 Last update: 2019-08-18 07:38

news

[2019-03-09] Accepted php7.0 7.0.33-0+deb9u3 (source) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)
[2019-03-08] Accepted php7.0 7.0.33-0+deb9u3 (source) into stable->embargoed, stable (Ondřej Surý)
[2019-03-07] Accepted php7.0 7.0.33-0+deb9u2 (source amd64 all) into proposed-updates->stable-new, proposed-updates (Moritz Mühlenhoff)
[2019-02-28] Accepted php7.0 7.0.33-0+deb9u2 (source amd64 all) into stable->embargoed, stable (Moritz Mühlenhoff)
[2018-12-18] Accepted php7.0 7.0.33-0+deb9u1 (source) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)
[2018-12-10] Accepted php7.0 7.0.33-0+deb9u1 (source) into stable->embargoed, stable (Ondřej Surý)
[2018-10-08] Removed 7.0.32-1 from unstable (Debian FTP Masters)
[2018-10-08] Removed 7.0.31-1 from unstable (Debian FTP Masters)
[2018-10-08] Removed 7.0.14-2 from unstable (Debian FTP Masters)
[2018-10-03] Accepted php7.0 7.0.32-1 (source) into unstable (Ondřej Surý)
[2018-10-03] php7.0 REMOVED from testing (Debian testing watch)
[2018-08-06] php7.0 7.0.31-1 MIGRATED to testing (Debian testing watch)
[2018-08-04] php7.0 7.0.30-2 MIGRATED to testing (Debian testing watch)
[2018-08-04] Accepted php7.0 7.0.31-1 (source) into unstable (Lior Kaplan)
[2018-07-11] Accepted php7.0 7.0.30-2 (source) into unstable (Ondřej Surý)
[2018-07-11] Accepted php7.0 7.0.30-1 (source) into unstable (Ondřej Surý)
[2018-07-06] Accepted php7.0 7.0.30-0+deb9u1 (source amd64 all) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)
[2018-07-05] Accepted php7.0 7.0.30-0+deb9u1 (source amd64 all) into stable->embargoed, stable (Ondřej Surý)
[2018-06-02] php7.0 REMOVED from testing (Debian testing watch)
[2018-04-13] php7.0 7.0.29-1 MIGRATED to testing (Debian testing watch)
[2018-04-05] Accepted php7.0 7.0.29-1 (source) into unstable (Ondřej Surý)
[2018-03-11] php7.0 7.0.28-1 MIGRATED to testing (Debian testing watch)
[2018-03-06] Accepted php7.0 7.0.28-1 (source) into unstable (Ondřej Surý)
[2018-02-09] Accepted php7.0 7.0.27-0+deb9u1 (source) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)
[2018-01-10] php7.0 7.0.27-1 MIGRATED to testing (Debian testing watch)
[2018-01-05] Accepted php7.0 7.0.27-1 (source) into unstable (Ondřej Surý)
[2017-12-04] php7.0 7.0.26-1 MIGRATED to testing (Debian testing watch)
[2017-11-29] Accepted php7.0 7.0.26-1 (source) into unstable (Ondřej Surý)
[2017-11-17] php7.0 7.0.25-1 MIGRATED to testing (Debian testing watch)
[2017-11-12] Accepted php7.0 7.0.25-1 (source) into unstable (Ondřej Surý)

1
2

bugs [bug history graph]

all: 2
RC: 1
I&N: 0
M&W: 1
F&P: 0
patch: 0

links

homepage
buildd: logs, clang, cross
popcon
browse source code
edit tags
security tracker
screenshots

Debian Package Tracker — Copyright 2013-2018 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing