Register | Log in

php7.3

Choose email to subscribe with

general

source: php7.3 (updates)
version: 7.3.19-1~deb10u1
maintainer: Debian PHP Maintainers (DMD)
uploaders: Lior Kaplan [DMD] – Ondřej Surý [DMD]
arch: all any
std-ver: 3.9.7
VCS: Git (Browse)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

stable: 7.3.19-1~deb10u1
stable-sec: 7.3.19-1~deb10u1

versioned links

7.3.19-1~deb10u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

package is gone

This package is not in any development repository. This probably means that the package has been removed (or has been renamed). Thus the information here is of little interest ... the package is going to disappear unless someone takes it over and reintroduces it.

action needed

5 security issues in buster high

There are 5 open security issues in buster.

1 important issue:

CVE-2020-7069: In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.

4 issues skipped by the security teams:

CVE-2017-7189: main/streams/xp_socket.c in PHP 7.x before 2017-03-07 misparses fsockopen calls, such as by interpreting fsockopen('127.0.0.1:80', 443) as if the address/port were 127.0.0.1:80:443, which is later truncated to 127.0.0.1:80. This behavior has a security risk if the explicitly provided port number (i.e., 443 in this example) is hardcoded into an application as a security policy, but the hostname argument (i.e., 127.0.0.1:80 in this example) is obtained from untrusted input.
CVE-2017-7272: PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function.
CVE-2020-7068: In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.
CVE-2020-7070: In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.

Please fix them.

Created: 2019-05-04 Last update: 2020-10-13 09:30

news

[2020-07-08] Accepted php7.3 7.3.19-1~deb10u1 (source amd64 all) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Ondřej Surý)
[2020-07-08] Accepted php7.3 7.3.14-1~deb10u1 (source) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Ondřej Surý)
[2020-07-06] Accepted php7.3 7.3.19-1~deb10u1 (source amd64 all) into stable->embargoed, stable (Debian FTP Masters) (signed by: Ondřej Surý)
[2020-06-24] php7.3 REMOVED from testing (Debian testing watch)
[2020-03-24] Removed 7.3.15-3 from unstable (Debian FTP Masters)
[2020-02-25] php7.3 7.3.15-3 MIGRATED to testing (Debian testing watch)
[2020-02-23] Accepted php7.3 7.3.15-3 (source) into unstable (Ondřej Surý)
[2020-02-21] Accepted php7.3 7.3.15-2 (source) into unstable (Ondřej Surý)
[2020-02-20] Accepted php7.3 7.3.15-1 (source) into unstable (Ondřej Surý)
[2020-02-17] Accepted php7.3 7.3.14-1~deb10u1 (source) into stable->embargoed, stable (Ondřej Surý)
[2019-12-06] php7.3 7.3.12-1 MIGRATED to testing (Debian testing watch)
[2019-12-01] Accepted php7.3 7.3.12-1 (source) into unstable (Ondřej Surý)
[2019-10-29] Accepted php7.3 7.3.11-1~deb10u1 (source) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)
[2019-10-28] Accepted php7.3 7.3.11-1~deb10u1 (source) into stable->embargoed, stable (Ondřej Surý)
[2019-10-10] php7.3 7.3.10-1 MIGRATED to testing (Debian testing watch)
[2019-10-08] Accepted php7.3 7.3.10-1 (source) into unstable (Ondřej Surý)
[2019-09-21] Accepted php7.3 7.3.9-1~deb10u1 (source amd64 all) into proposed-updates->stable-new, proposed-updates (Ondřej Surý)
[2019-09-20] php7.3 7.3.9-1 MIGRATED to testing (Debian testing watch)
[2019-09-19] Accepted php7.3 7.3.9-1~deb10u1 (source amd64 all) into stable->embargoed, stable (Ondřej Surý)
[2019-09-18] Accepted php7.3 7.3.9-1 (source) into unstable (Ondřej Surý)
[2019-08-10] php7.3 7.3.8-1 MIGRATED to testing (Debian testing watch)
[2019-08-08] Accepted php7.3 7.3.8-1 (source) into unstable (Ondřej Surý)
[2019-08-08] php7.3 7.3.6-1 MIGRATED to testing (Debian testing watch)
[2019-05-31] Accepted php7.3 7.3.6-1 (source) into unstable (Ondřej Surý)
[2019-04-21] php7.3 7.3.4-2 MIGRATED to testing (Debian testing watch)
[2019-04-13] Accepted php7.3 7.3.4-2 (source) into unstable (Ondřej Surý)
[2019-04-10] Accepted php7.3 7.3.4-1 (source) into unstable (Ondřej Surý)
[2019-03-18] php7.3 7.3.3-1 MIGRATED to testing (Debian testing watch)
[2019-03-07] Accepted php7.3 7.3.3-1 (source) into unstable (Ondřej Surý)
[2019-02-11] php7.3 7.3.2-3 MIGRATED to testing (Debian testing watch)

1
2

bugs [bug history graph]

all: 2
RC: 0
I&N: 2
M&W: 0
F&P: 0
patch: 0

links

homepage
buildd: logs, clang, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots
debci

Debian Package Tracker — Copyright 2013-2018 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing