This bug was fixed in the package php5 - 5.3.2-1ubuntu4.26 --------------- php5 (5.3.2-1ubuntu4.26) lucid-security; urgency=medium
* SECURITY UPDATE: denial of service in FileInfo cdf_read_short_sector - debian/patches/CVE-2014-0207.patch: properly calculate sizes in ext/fileinfo/libmagic/cdf.c. - CVE-2014-0207 * SECURITY UPDATE: denial of service in FileInfo cdf_count_chain - debian/patches/CVE-2014-3480.patch: properly calculate sizes in ext/fileinfo/libmagic/cdf.c. - CVE-2014-3480 * SECURITY UPDATE: denial of service and possible code execution via unserialize() SPL type confusion - debian/patches/CVE-2014-3515.patch: properly check types in ext/spl/spl_array.c, ext/spl/spl_observer.c, added test to ext/spl/tests/SplObjectStorage_unserialize_bad.phpt. - CVE-2014-3515 * SECURITY UPDATE: denial of service via SPL Iterators use-after-free - debian/patches/CVE-2014-4670.patch: fix use-after-free in ext/spl/spl_dllist.c, added test to ext/spl/tests/bug67538.phpt. - CVE-2014-4670 * SECURITY UPDATE: denial of service via ArrayIterator use-after-free - debian/patches/CVE-2014-4698.patch: don't allow modifying ArrayObject during sorting in ext/spl/spl_array.c, added test to ext/spl/tests/bug67539.phpt. - CVE-2014-4698 * SECURITY UPDATE: information leak via phpinfo (LP: #1338170) - debian/patches/CVE-2014-4721.patch: fix type confusion in ext/standard/info.c, added test to ext/standard/tests/general_functions/bug67498.phpt. - CVE-2014-4721 -- Marc Deslauriers <marc.deslauri...@ubuntu.com> Tue, 08 Jul 2014 21:22:42 -0400 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1338170 Title: PHP 5 infoleak vulnerability leading to potential SSL key disclosure To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1338170/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs