| Description: | Summary:
The remote host is missing an update for the 'php55, php55-php' package(s) announced via the ELSA-2015-1053 advisory.
Vulnerability Insight:
php55
[2.0-1]
- fix incorrect selinux contexts #1194336
php55-php
[5.5.21-2.0.1]
- add dtrace-utils as build dependency
[5.5.21-2]
- core: fix use-after-free vulnerability in the
process_nested_data function (unserialize) CVE-2015-2787
- core: fix NUL byte injection in file name argument of
move_uploaded_file() CVE-2015-2348
- date: fix use after free vulnerability in unserialize()
with DateTimeZone CVE-2015-0273
- enchant: fix heap buffer overflow in
enchant_broker_request_dict() CVE-2014-9705
- ereg: fix heap overflow in regcomp() CVE-2015-2305
- opcache: fix use after free CVE-2015-1351
- phar: fix use after free in phar_object.c CVE-2015-2301
- pgsql: fix NULL pointer dereference CVE-2015-1352
- soap: fix type confusion through unserialize #1204868
[5.5.21-1]
- rebase to PHP 5.5.21
[5.5.20-1]
- rebase to PHP 5.5.20 #1057089
- fix package name in description
- php-fpm own session and wsdlcache dir
- php-common doesn't provide php-gmp
Affected Software/OS:
'php55, php55-php' package(s) on Oracle Linux 6, Oracle Linux 7.
Solution:
Please install the updated package(s).
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
