Fedora 20 : php-phpunit-PHPUnit-MockObject-1.2.3-4.fc20 / php-5.5.13-3.fc20 / etc (2014-6901)

medium Nessus Plugin ID 76093

Language:

Synopsis

The remote Fedora host is missing one or more security updates.

Description

29 May 2014, PHP 5.5.13

CLI server :

- Fixed bug #67079 (Missing MIME types for XML/XSL files).
(Anatol)

COM :

- Fixed bug #66431 (Special Character via COM Interface (CP_UTF8)). (Anatol)

Core :

- Fixed bug #65701 (copy() doesn't work when destination filename is created by tempnam()). (Boro Sitnikovski)

- Fixed bug #67072 (Echoing unserialized 'SplFileObject' crash). (Anatol)

- Fixed bug #67245 (usage of memcpy() with overlapping src and dst in zend_exceptions.c). (Bob)

- Fixed bug #67247 (spl_fixedarray_resize integer overflow). (Stas)

- Fixed bug #67249 (printf out-of-bounds read). (Stas)

- Fixed bug #67250 (iptcparse out-of-bounds read).
(Stas)

- Fixed bug #67252 (convert_uudecode out-of-bounds read). (Stas)

Curl :

- Fixed bug #64247 (CURLOPT_INFILE doesn't allow reset).
(Mike)

Date :

- Fixed bug #67118 (DateTime constructor crash with invalid data). (Anatol)

- Fixed bug #67251 (date_parse_from_format out-of-bounds read). (Stas)

- Fixed bug #67253 (timelib_meridian_with_check out-of-bounds read). (Stas)

DOM :

- Fixed bug #67081 (DOMDocumentType->internalSubset returns entire DOCTYPE tag, not only the subset).
(Anatol)

Fileinfo :

- Fixed bug #66307 (Fileinfo crashes with powerpoint files). (Anatol)

- Fixed bug #67327 (fileinfo: CDF infinite loop in nelements DoS) (CVE-2014-0238).

- Fixed bug #67328 (fileinfo: fileinfo: numerous file_printf calls resulting in performance degradation) (CVE-2014-0237).

FPM :

- Fixed bug #66908 (php-fpm reload leaks epoll_create() file descriptor). (Julio Pintos)

GD :

- Fixed bug #67248 (imageaffinematrixget missing check of parameters). (Stas)

PCRE :

- Fixed bug #67238 (Ungreedy and min/max quantifier bug, applied patch from the upstream). (Anatol)

Phar :

- Fix bug #64498 ($phar->buildFromDirectory can't compress file with an accent in its name). (PR #588)

Backported from 5.5.14 :

- Fileinfo: Fixed bug #67326 (fileinfo:
cdf_read_short_sector insufficient boundary check).

- Core: workaround regression introduce in fix for #67072

- Date: Fixed regression in fix for bug #67118 (constructor can't be called twice).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected php, php-doctrine-orm and / or php-phpunit-PHPUnit-MockObject packages.

Plugin Details

Severity: Medium

ID: 76093

File Name: fedora_2014-6901.nasl

Version: 1.6

Type: local

Agent: unix

Family: Fedora Local Security Checks

Published: 6/18/2014

Updated: 1/11/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

CPE: cpe:/o:fedoraproject:fedora:20, p-cpe:/a:fedoraproject:fedora:php-phpunit-phpunit-mockobject, p-cpe:/a:fedoraproject:fedora:php, p-cpe:/a:fedoraproject:fedora:php-doctrine-orm

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 5/30/2014

Reference Information

CVE: CVE-2014-0237, CVE-2014-0238

BID: 67759, 67765

FEDORA: 2014-6901

Detections

Analytics