stable
FEDORA-2016-62fc05fd68 created by remi 5 years ago for Fedora 24

15 Sep 2016 PHP version 5.6.26

Core:

  • Fixed bug #72907 (null pointer deref, segfault in gc_remove_zval_from_buffer (zend_gc.c:260)). (Laruence)

Dba:

  • Fixed bug #71514 (Bad dba_replace condition because of wrong API usage). (cmb)
  • Fixed bug #70825 (Cannot fetch multiple values with group in ini file). (cmb)

EXIF:

  • Fixed bug #72926 (Uninitialized Thumbail Data Leads To Memory Leakage in exif_process_IFD_in_TIFF). (Stas)

FTP:

  • Fixed bug #70195 (Cannot upload file using ftp_put to FTPES with require_ssl_reuse). (Benedict Singer)

GD:

  • Fixed bug #66005 (imagecopy does not support 1bit transparency on truecolor images). (cmb)
  • Fixed bug #72913 (imagecopy() loses single-color transparency on palette images). (cmb)
  • Fixed bug #68716 (possible resource leaks in _php_image_convert()). (cmb)

Intl:

  • Fixed bug #73007 (add locale length check). (Stas)

JSON:

  • Fixed bug #72787 (json_decode reads out of bounds). (Jakub Zelenka)

mbstring:

  • Fixed bug #66797 (mb_substr only takes 32-bit signed integer). (cmb)
  • Fixed bug #72910 (Out of bounds heap read in mbc_to_code() / triggered by mb_ereg_match()). (Stas)

MSSQL:

  • Fixed bug #72039 (Use of uninitialised value on mssql_guid_string). (Kalle)

Mysqlnd:

  • Fixed bug #72293 (Heap overflow in mysqlnd related to BIT fields). (Stas)

Phar:

  • Fixed bug #72928 (Out of bound when verify signature of zip phar in phar_parse_zipfile). (Stas)
  • Fixed bug #73035 (Out of bound when verify signature of tar phar in phar_parse_tarfile). (Stas)

PDO:

  • Fixed bug #60665 (call to empty() on NULL result using PDO::FETCH_LAZY returns false). (cmb)

PDO_pgsql:

  • Implemented FR #72633 (Postgres PDO lastInsertId() should work without specifying a sequence). (Pablo Santiago S├ínchez, Matteo)
  • Fixed bug #72759 (Regression in pgo_pgsql). (Anatol)

SPL:

  • Fixed bug #73029 (Missing type check when unserializing SplArray). (Stas)

Standard:

  • Fixed bug #72823 (strtr out-of-bound access). (cmb)
  • Fixed bug #72278 (getimagesize returning FALSE on valid jpg). (cmb)
  • Fixed bug #65550 (get_browser() incorrectly parses entries with "+" sign). (cmb)
  • Fixed bug #71882 (Negative ftruncate() on php://memory exhausts memory). (cmb)
  • Fixed bug #73011 (integer overflow in fgets cause heap corruption). (Stas)
  • Fixed bug #73017 (memory corruption in wordwrap function). (Stas)
  • Fixed bug #73045 (integer overflow in fgetcsv caused heap corruption). (Stas)
  • Fixed bug #73052 (Memory Corruption in During Deserialized-object Destruction) (Stas)

Streams:

  • Fixed bug #72853 (stream_set_blocking doesn't work). (Laruence)

Wddx:

  • Fixed bug #72860 (wddx_deserialize use-after-free). (Stas)
  • Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element). (Stas)

XML:

  • Fixed bug #72085 (SEGV on unknown address zif_xml_parse). (cmb)
  • Fixed bug #72927 (integer overflow in xml_utf8_encode). (Stas)

How to install

sudo dnf upgrade --refresh --advisory=FEDORA-2016-62fc05fd68

This update has been submitted for testing by remi.

5 years ago

This update has been pushed to testing.

5 years ago
User Icon bradw commented & provided feedback 5 years ago
karma

Personal LAMP and mail server running GNOME. All OK.

remi edited this update.

5 years ago
User Icon yuwata commented & provided feedback 5 years ago
karma

works for me

This update has been submitted for stable by remi.

5 years ago

This update has been pushed to stable.

5 years ago

Please login to add feedback.

Metadata
Type
security
Karma
2
Signed
Content Type
RPM
Test Gating
Settings
Unstable by Karma
-3
Stable by Karma
3
Stable by Time
disabled
Dates
submitted
5 years ago
in testing
5 years ago
in stable
5 years ago
modified
5 years ago
BZ#1377303 CVE-2016-7411 php: Memory corruption when destructing deserialized object
0
0
BZ#1377311 CVE-2016-7412 php: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field
0
0
BZ#1377314 CVE-2016-7413 php: Use after free in wddx_deserialize
0
0
BZ#1377336 CVE-2016-7414 php: Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile
0
0
BZ#1377340 CVE-2016-7416 php: Stack based buffer overflow in msgfmt_format_message
0
0
BZ#1377344 CVE-2016-7417 php: Missing type check when unserializing SplArray
0
0
BZ#1377352 CVE-2016-7418 php: Null pointer dereference in php_wddx_push_element
0
0
BZ#1377366 CVE-2016-7411 CVE-2016-7412 CVE-2016-7413 CVE-2016-7414 CVE-2016-7416 CVE-2016-7417 CVE-2016-7418 php: various flaws [fedora-all]
0
0

Automated Test Results