{"affected":[{"ecosystem_specific":{"binaries":[{"apache2-mod_php5":"5.5.14-11.3","php5":"5.5.14-11.3","php5-bcmath":"5.5.14-11.3","php5-bz2":"5.5.14-11.3","php5-calendar":"5.5.14-11.3","php5-ctype":"5.5.14-11.3","php5-curl":"5.5.14-11.3","php5-dba":"5.5.14-11.3","php5-dom":"5.5.14-11.3","php5-enchant":"5.5.14-11.3","php5-exif":"5.5.14-11.3","php5-fastcgi":"5.5.14-11.3","php5-fileinfo":"5.5.14-11.3","php5-fpm":"5.5.14-11.3","php5-ftp":"5.5.14-11.3","php5-gd":"5.5.14-11.3","php5-gettext":"5.5.14-11.3","php5-gmp":"5.5.14-11.3","php5-iconv":"5.5.14-11.3","php5-intl":"5.5.14-11.3","php5-json":"5.5.14-11.3","php5-ldap":"5.5.14-11.3","php5-mbstring":"5.5.14-11.3","php5-mcrypt":"5.5.14-11.3","php5-mysql":"5.5.14-11.3","php5-odbc":"5.5.14-11.3","php5-openssl":"5.5.14-11.3","php5-pcntl":"5.5.14-11.3","php5-pdo":"5.5.14-11.3","php5-pear":"5.5.14-11.3","php5-pgsql":"5.5.14-11.3","php5-pspell":"5.5.14-11.3","php5-shmop":"5.5.14-11.3","php5-snmp":"5.5.14-11.3","php5-soap":"5.5.14-11.3","php5-sockets":"5.5.14-11.3","php5-sqlite":"5.5.14-11.3","php5-suhosin":"5.5.14-11.3","php5-sysvmsg":"5.5.14-11.3","php5-sysvsem":"5.5.14-11.3","php5-sysvshm":"5.5.14-11.3","php5-tokenizer":"5.5.14-11.3","php5-wddx":"5.5.14-11.3","php5-xmlreader":"5.5.14-11.3","php5-xmlrpc":"5.5.14-11.3","php5-xmlwriter":"5.5.14-11.3","php5-xsl":"5.5.14-11.3","php5-zip":"5.5.14-11.3","php5-zlib":"5.5.14-11.3"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","name":"php5","purl":"pkg:rpm/suse/php5&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"5.5.14-11.3"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"php5-devel":"5.5.14-11.3"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","name":"php5","purl":"pkg:rpm/suse/php5&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"5.5.14-11.3"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"php5 was updated to fix four security issues.\n\nThese security issues were fixed:\n- CVE-2015-0231: Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allowed remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8142 (bnc#910659).\n- CVE-2014-9427: sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, did not properly consider the mapping's length during processing of an invalid file that begins with a # character and lacks a newline character, which caused an out-of-bounds read and might (1) allow remote attackers to obtain sensitive information from php-cgi process memory by leveraging the ability to upload a .php file or (2) trigger unexpected code execution if a valid PHP script is present in memory locations adjacent to the mapping (bnc#911664).\n- CVE-2015-0232: The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allowed remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free and application crash) via crafted EXIF data in a JPEG image (bnc#914690).\n- CVE-2014-8142: Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allowed remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object, a different vulnerability than CVE-2004-1019 (bnc#910659).\n\nAdditionally a fix was included that protects against a possible NULL pointer use (bnc#910659). \n\nThis non-security issue was fixed:\n- php53 ignored default_socket_timeout on outgoing SSL connection (bnc#907519).\n","id":"SUSE-SU-2015:0365-1","modified":"2015-02-13T01:35:12Z","published":"2015-02-13T01:35:12Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150365-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/907519"},{"type":"REPORT","url":"https://bugzilla.suse.com/910659"},{"type":"REPORT","url":"https://bugzilla.suse.com/911664"},{"type":"REPORT","url":"https://bugzilla.suse.com/914690"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2014-8142"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2014-9427"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-0231"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2015-0232"}],"related":["CVE-2014-8142","CVE-2014-9427","CVE-2015-0231","CVE-2015-0232"],"summary":"Security update for php5","upstream":["CVE-2014-8142","CVE-2014-9427","CVE-2015-0231","CVE-2015-0232"]}