Synopsis: Moderate: php security and bug fix update
Advisory ID: SLSA-2016:1613-1
Issue Date: 2016-08-11
CVE Numbers: CVE-2016-5385
—
Security Fix(es):
* It was discovered that PHP did not properly protect against the
HTTP_PROXY variable name clash. A remote attacker could possibly use this
flaw to redirect HTTP requests performed by a PHP script to an attacker-
controlled proxy via a malicious HTTP request. (CVE-2016-5385)
Bug Fix(es):
* Previously, an incorrect logic in the SAPI header callback routine
caused that the callback counter was not incremented. Consequently, when a
script included a header callback, it could terminate unexpectedly with a
segmentation fault. With this update, the callback counter is properly
managed, and scripts with a header callback implementation work as
expected.
—
SL7
x86_64
php-5.4.16-36.3.el7_2.x86_64.rpm
php-bcmath-5.4.16-36.3.el7_2.x86_64.rpm
php-cli-5.4.16-36.3.el7_2.x86_64.rpm
php-common-5.4.16-36.3.el7_2.x86_64.rpm
php-dba-5.4.16-36.3.el7_2.x86_64.rpm
php-debuginfo-5.4.16-36.3.el7_2.x86_64.rpm
php-devel-5.4.16-36.3.el7_2.x86_64.rpm
php-embedded-5.4.16-36.3.el7_2.x86_64.rpm
php-enchant-5.4.16-36.3.el7_2.x86_64.rpm
php-fpm-5.4.16-36.3.el7_2.x86_64.rpm
php-gd-5.4.16-36.3.el7_2.x86_64.rpm
php-intl-5.4.16-36.3.el7_2.x86_64.rpm
php-ldap-5.4.16-36.3.el7_2.x86_64.rpm
php-mbstring-5.4.16-36.3.el7_2.x86_64.rpm
php-mysql-5.4.16-36.3.el7_2.x86_64.rpm
php-mysqlnd-5.4.16-36.3.el7_2.x86_64.rpm
php-odbc-5.4.16-36.3.el7_2.x86_64.rpm
php-pdo-5.4.16-36.3.el7_2.x86_64.rpm
php-pgsql-5.4.16-36.3.el7_2.x86_64.rpm
php-process-5.4.16-36.3.el7_2.x86_64.rpm
php-pspell-5.4.16-36.3.el7_2.x86_64.rpm
php-recode-5.4.16-36.3.el7_2.x86_64.rpm
php-snmp-5.4.16-36.3.el7_2.x86_64.rpm
php-soap-5.4.16-36.3.el7_2.x86_64.rpm
php-xml-5.4.16-36.3.el7_2.x86_64.rpm
php-xmlrpc-5.4.16-36.3.el7_2.x86_64.rpm
– Scientific Linux Development Team
