Test ID:	1.3.6.1.4.1.25623.1.1.10.2014.0430
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2014-0430)
Summary:	The remote host is missing an update for the 'php, php-apc, php-gd-bundled, php-suhosin' package(s) announced via the MGASA-2014-0430 advisory.
Description:	Summary: The remote host is missing an update for the 'php, php-apc, php-gd-bundled, php-suhosin' package(s) announced via the MGASA-2014-0430 advisory. Vulnerability Insight: An integer overflow flaw in PHP's unserialize() function was reported. If unserialize() were used on untrusted data, this issue could lead to a crash or potentially information disclosure (CVE-2014-3669). A heap corruption issue was reported in PHP's exif_thumbnail() function. A specially-crafted JPEG image could cause the PHP interpreter to crash or, potentially, execute arbitrary code (CVE-2014-3670). If client-supplied input was passed to PHP's cURL client as a URL to download, it could return local files from the server due to improper handling of null bytes (PHP#68089). PHP has been updated to version 5.4.34 for Mageia 3 and 5.5.18 for Mageia 4, which fix these issues and other bugs. Additionally, the suhosin PHP extension has been updated to version 0.9.36 and a bug in the php zip extension that could cause a crash on Mageia 4 has been fixed (mga#13820) Affected Software/OS: 'php, php-apc, php-gd-bundled, php-suhosin' package(s) on Mageia 3, Mageia 4. Solution: Please install the updated package(s). CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-2014 https://lists.fedoraproject.org/pipermail/package-announce/2014-February/128293.html http://www.mandriva.com/security/advisories?name=MDVSA-2014:060 http://www.linux-france.org/prj/imapsync_list/msg01907.html http://www.linux-france.org/prj/imapsync_list/msg01910.html http://seclists.org/oss-sec/2014/q1/367 http://seclists.org/oss-sec/2014/q1/378
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.