FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

php -- multiple vulnerabilities

Affected packages
	php70	<	7.0.5
	php70-fileinfo	<	7.0.5
	php70-mbstring	<	7.0.5
	php70-phar	<	7.0.5
	php70-snmp	<	7.0.5
	php56	<	5.6.20
	php56-fileinfo	<	5.6.20
	php56-mbstring	<	5.6.20
	php56-phar	<	5.6.20
	php56-snmp	<	5.6.20
	php55	<	5.5.34
	php55-fileinfo	<	5.5.34
	php55-mbstring	<	5.5.34
	php55-phar	<	5.5.34
	php55-snmp	<	5.5.34

Details

VuXML ID	482d40cb-f9a3-11e5-92ce-002590263bf5
Discovery	2016-03-31
Entry	2016-04-03

The PHP Group reports:

Fileinfo:

Fixed bug #71527 (Buffer over-write in finfo_open with malformed magic file).

mbstring:

Fixed bug #71906 (AddressSanitizer: negative-size-param (-1) in mbfl_strcut).

Phar:

Fixed bug #71860 (Invalid memory write in phar on filename with \0 in name).

SNMP:

Fixed bug #71704 (php_snmp_error() Format String Vulnerability).

Standard:

Fixed bug #71798 (Integer Overflow in php_raw_url_encode).

[source]

References

FreeBSD PR	ports/208465
URL	http://php.net/ChangeLog-5.php#5.5.34
URL	http://php.net/ChangeLog-5.php#5.6.20
URL	http://php.net/ChangeLog-7.php#7.0.5