[ GLSA 201408-11 ] PHP: Multiple vulnerabilities

[GLSA]

Gentoo Linux Security Advisory

Title: PHP: Multiple vulnerabilities (GLSA 201408-11)
Severity: high
Exploitable: remote
Date: August 29, 2014
Updated: January 02, 2015
Bug(s): #459904, #472204, #472558, #474656, #476570, #481004, #483212, #485252, #492784, #493982, #501312, #503630, #503670, #505172, #505712, #509132, #512288, #512492, #513032, #516994, #519932, #520134, #520438
ID: 201408-11

Synopsis

Multiple vulnerabilities have been discovered in PHP, the worst of
which could lead to remote execution of arbitrary code.


Background

PHP is a widely-used general-purpose scripting language that is
especially suited for Web development and can be embedded into HTML.


Affected Packages

Package: dev-lang/php
Vulnerable: < 5.5.16
Unaffected: >= 5.5.16
Unaffected: >= 5.4.32 < 5.4.33
Unaffected: >= 5.3.29 < 5.3.30
Unaffected: >= 5.4.34 < 5.4.35
Unaffected: >= 5.4.35 < 5.4.36
Unaffected: >= 5.4.36 < 5.4.37
Unaffected: >= 5.4.37 < 5.4.38
Unaffected: >= 5.4.38 < 5.4.39
Architectures: All supported architectures


Description

Multiple vulnerabilities have been discovered in PHP. Please review the
CVE identifiers referenced below for details.


Impact

A context-dependent attacker can cause arbitrary code execution, create
a Denial of Service condition, read or write arbitrary files, impersonate
other servers, hijack a web session, or have other unspecified impact.
Additionally, a local attacker could gain escalated privileges.


Workaround

There is no known workaround at this time.

Resolution

All PHP 5.5 users should upgrade to the latest version: