Register | Log in

php7.3

server-side, HTML-embedded scripting language (metapackage)

Choose email to subscribe with

general

source: php7.3 (main)
version: 7.3.15-3
maintainer: Debian PHP Maintainers (DMD)
uploaders: Lior Kaplan [DMD] – Ondřej Surý [DMD]
arch: all any
std-ver: 4.5.0.0
VCS: Git (Browse)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

stable: 7.3.11-1~deb10u1
stable-sec: 7.3.14-1~deb10u1
testing: 7.3.15-3

versioned links

7.3.11-1~deb10u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.3.14-1~deb10u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.3.15-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

package is gone

This package is not in any development repository. This probably means that the package has been removed (or has been renamed). Thus the information here is of little interest ... the package is going to disappear unless someone takes it over and reintroduces it.

action needed

8 security issues in buster high

There are 8 open security issues in buster.

4 important issues:

CVE-2019-11048: In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleaning up temporary files created by upload request. This potentially could lead to accumulation of uncleaned temporary files exhausting the disk space on the target server.
CVE-2020-7064: In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while parsing EXIF data with exif_read_data() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash.
CVE-2020-7065: In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.
CVE-2020-7066: In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the get_headers() and possibly send some information to a wrong server.

4 issues skipped by the security teams:

CVE-2017-7272: PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.
CVE-2017-7189: main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen('127.0.0.1:80', 443) as if the address/port were 127.0.0.1:80:443, which is later truncated to 127.0.0.1:80. This behavior has a security risk if the explicitly provided port number (i.e., 443 in this example) is hardcoded into an application as a security policy, but the hostname argument (i.e., 127.0.0.1:80 in this example) is obtained from untrusted input.
CVE-2020-7062: In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.upload_progress.cleanup is set to 0 (disabled), and the file upload fails, the upload procedure would try to clean up data that does not exist and encounter null pointer dereference, which would likely lead to a crash.
CVE-2020-7063: In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the files are added with default permissions (0666, or all access) even if the original files on the filesystem were with more restrictive permissions. This may result in files having more lax permissions than intended when such archive is extracted.

Please fix them.

Created: 2019-05-04 Last update: 2020-05-22 05:00

6 security issues in bullseye high

There are 6 open security issues in bullseye.

6 important issues:

CVE-2017-7272: PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.
CVE-2017-7189: main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen('127.0.0.1:80', 443) as if the address/port were 127.0.0.1:80:443, which is later truncated to 127.0.0.1:80. This behavior has a security risk if the explicitly provided port number (i.e., 443 in this example) is hardcoded into an application as a security policy, but the hostname argument (i.e., 127.0.0.1:80 in this example) is obtained from untrusted input.
CVE-2019-11048: In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the request, without cleaning up temporary files created by upload request. This potentially could lead to accumulation of uncleaned temporary files exhausting the disk space on the target server.
CVE-2020-7064: In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while parsing EXIF data with exif_read_data() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash.
CVE-2020-7065: In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.34, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.
CVE-2020-7066: In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the get_headers() and possibly send some information to a wrong server.

Please fix them.

Created: 2019-07-07 Last update: 2020-05-22 05:00

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2018-09-11 Last update: 2020-05-25 02:05

news

[2020-03-24] Removed 7.3.15-3 from unstable (Debian FTP Masters)
[2020-02-25] php7.3 7.3.15-3 MIGRATED to testing (Debian testing watch)
[2020-02-25] php7.3 7.3.15-3 MIGRATED to testing (Debian testing watch)
[2020-02-23] Accepted php7.3 7.3.15-3 (source) into unstable (Ondřej Surý)
[2020-02-21] Accepted php7.3 7.3.15-2 (source) into unstable (Ondřej Surý)
[2020-02-20] Accepted php7.3 7.3.15-1 (source) into unstable (Ondřej Surý)
[2020-02-17] Accepted php7.3 7.3.14-1~deb10u1 (source) into stable->embargoed, stable (Ondřej Surý)
[2019-12-06] php7.3 7.3.12-1 MIGRATED to testing (Debian testing watch)
[2019-12-01] Accepted php7.3 7.3.12-1 (source) into unstable (Ondřej Surý)
[2019-10-29] Accepted php7.3 7.3.11-1~deb10u1 (source) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)
[2019-10-28] Accepted php7.3 7.3.11-1~deb10u1 (source) into stable->embargoed, stable (Ondřej Surý)
[2019-10-10] php7.3 7.3.10-1 MIGRATED to testing (Debian testing watch)
[2019-10-08] Accepted php7.3 7.3.10-1 (source) into unstable (Ondřej Surý)
[2019-09-21] Accepted php7.3 7.3.9-1~deb10u1 (source amd64 all) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)
[2019-09-20] php7.3 7.3.9-1 MIGRATED to testing (Debian testing watch)
[2019-09-19] Accepted php7.3 7.3.9-1~deb10u1 (source amd64 all) into stable->embargoed, stable (Ondřej Surý)
[2019-09-18] Accepted php7.3 7.3.9-1 (source) into unstable (Ondřej Surý)
[2019-08-10] php7.3 7.3.8-1 MIGRATED to testing (Debian testing watch)
[2019-08-08] Accepted php7.3 7.3.8-1 (source) into unstable (Ondřej Surý)
[2019-08-08] php7.3 7.3.6-1 MIGRATED to testing (Debian testing watch)
[2019-05-31] Accepted php7.3 7.3.6-1 (source) into unstable (Ondřej Surý)
[2019-04-21] php7.3 7.3.4-2 MIGRATED to testing (Debian testing watch)
[2019-04-13] Accepted php7.3 7.3.4-2 (source) into unstable (Ondřej Surý)
[2019-04-10] Accepted php7.3 7.3.4-1 (source) into unstable (Ondřej Surý)
[2019-03-18] php7.3 7.3.3-1 MIGRATED to testing (Debian testing watch)
[2019-03-07] Accepted php7.3 7.3.3-1 (source) into unstable (Ondřej Surý)
[2019-02-11] php7.3 7.3.2-3 MIGRATED to testing (Debian testing watch)
[2019-02-08] Accepted php7.3 7.3.2-3 (source) into unstable (Ondřej Surý)
[2019-02-08] Accepted php7.3 7.3.2-2 (source) into unstable (Ondřej Surý)
[2019-02-08] php7.3 7.3.1-3 MIGRATED to testing (Debian testing watch)

1
2

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
buildd: logs, clang, reproducibility, cross
popcon
browse source code
edit tags
security tracker
screenshots
debci

Debian Package Tracker — Copyright 2013-2018 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing