{"affected":[{"ecosystem_specific":{"binaries":[{"apache2-mod_php7":"7.0.7-35.1","php7":"7.0.7-35.1","php7-bcmath":"7.0.7-35.1","php7-bz2":"7.0.7-35.1","php7-calendar":"7.0.7-35.1","php7-ctype":"7.0.7-35.1","php7-curl":"7.0.7-35.1","php7-dba":"7.0.7-35.1","php7-dom":"7.0.7-35.1","php7-enchant":"7.0.7-35.1","php7-exif":"7.0.7-35.1","php7-fastcgi":"7.0.7-35.1","php7-fileinfo":"7.0.7-35.1","php7-fpm":"7.0.7-35.1","php7-ftp":"7.0.7-35.1","php7-gd":"7.0.7-35.1","php7-gettext":"7.0.7-35.1","php7-gmp":"7.0.7-35.1","php7-iconv":"7.0.7-35.1","php7-imap":"7.0.7-35.1","php7-intl":"7.0.7-35.1","php7-json":"7.0.7-35.1","php7-ldap":"7.0.7-35.1","php7-mbstring":"7.0.7-35.1","php7-mcrypt":"7.0.7-35.1","php7-mysql":"7.0.7-35.1","php7-odbc":"7.0.7-35.1","php7-opcache":"7.0.7-35.1","php7-openssl":"7.0.7-35.1","php7-pcntl":"7.0.7-35.1","php7-pdo":"7.0.7-35.1","php7-pear":"7.0.7-35.1","php7-pear-Archive_Tar":"7.0.7-35.1","php7-pgsql":"7.0.7-35.1","php7-phar":"7.0.7-35.1","php7-posix":"7.0.7-35.1","php7-pspell":"7.0.7-35.1","php7-shmop":"7.0.7-35.1","php7-snmp":"7.0.7-35.1","php7-soap":"7.0.7-35.1","php7-sockets":"7.0.7-35.1","php7-sqlite":"7.0.7-35.1","php7-sysvmsg":"7.0.7-35.1","php7-sysvsem":"7.0.7-35.1","php7-sysvshm":"7.0.7-35.1","php7-tokenizer":"7.0.7-35.1","php7-wddx":"7.0.7-35.1","php7-xmlreader":"7.0.7-35.1","php7-xmlrpc":"7.0.7-35.1","php7-xmlwriter":"7.0.7-35.1","php7-xsl":"7.0.7-35.1","php7-zip":"7.0.7-35.1","php7-zlib":"7.0.7-35.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","name":"php7","purl":"pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"7.0.7-35.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"php7-devel":"7.0.7-35.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","name":"php7","purl":"pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP1"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"7.0.7-35.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"php7-devel":"7.0.7-35.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","name":"php7","purl":"pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP2"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"7.0.7-35.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"\nThis update for php7 fixes the following security issues:\n\n- CVE-2016-7480: The SplObjectStorage unserialize implementation in\n  ext/spl/spl_observer.c in PHP did not verify that a key is an object,\n  which allowed remote attackers to execute arbitrary code or cause a denial\n  of service (uninitialized memory access) via crafted serialized data.\n  (bsc#1019568)\n- CVE-2017-5340: Zend/zend_hash.c in PHP mishandled certain cases that\n  require large array allocations, which allowed remote attackers to\n  execute arbitrary code or cause a denial of service (integer overflow,\n  uninitialized memory access, and use of arbitrary destructor function\n  pointers) via crafted serialized data. (bsc#1019570)\n- CVE-2016-7479: In all versions of PHP 7, during the unserialization\n  process, resizing the 'properties' hash table of a serialized object may\n  have lead to use-after-free. A remote attacker may exploit this bug to\n  gain arbitrary code execution. (bsc#1019547)\n- CVE-2016-7478: Zend/zend_exceptions.c in PHP allowed remote attackers to\n  cause a denial of service (infinite loop) via a crafted Exception object\n  in serialized data, a related issue to CVE-2015-8876.  (bsc#1019550)\n- CVE-2016-10159: Integer overflow in the phar_parse_pharfile function\n  in ext/phar/phar.c in PHP allowed remote attackers to cause a denial\n  of service (memory consumption or application crash) via a truncated\n  manifest entry in a PHAR archive. (bsc#1022255)\n- CVE-2016-10160: Off-by-one error in the phar_parse_pharfile function\n  in ext/phar/phar.c in PHP allowed remote attackers to cause a denial\n  of service (memory corruption) or possibly execute arbitrary code via\n  a crafted PHAR archive with an alias mismatch. (bsc#1022257)\n- CVE-2016-10161: The object_common1 function in\n  ext/standard/var_unserializer.c in PHP allowed remote attackers to\n  cause a denial of service (buffer over-read and application crash) via\n  crafted serialized data that is mishandled in a finish_nested_data call.\n  (bsc#1022260)\n- CVE-2016-10162: The php_wddx_pop_element function in ext/wddx/wddx.c in\n  PHP 7 allowed remote attackers to cause a denial of service (NULL pointer\n  dereference and application crash) via an inapplicable class name in a\n  wddxPacket XML document, leading to mishandling in a wddx_deserialize\n  call. (bsc#1022262)\n- CVE-2016-10166: A potential unsigned underflow in gd interpolation\n  functions could lead to memory corruption in the PHP gd module\n  (bsc#1022263)\n- CVE-2016-10167: A denial of service problem in gdImageCreateFromGd2Ctx()\n  could lead to php out of memory even on small files. (bsc#1022264)\n- CVE-2016-10168: A signed integer overflow in the gd module could lead\n  to memory corruption (bsc#1022265)\n- CVE-2016-9138: PHP mishandled property modification during __wakeup\n  processing, which allows remote attackers to cause a denial of\n  service or possibly have unspecified other impact via crafted\n  serialized data, as demonstrated by Exception::__toString with\n  DateInterval::__wakeup. (bsc#1008026)\n","id":"SUSE-SU-2017:0534-1","modified":"2017-02-22T09:00:09Z","published":"2017-02-22T09:00:09Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170534-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1008026"},{"type":"REPORT","url":"https://bugzilla.suse.com/1019547"},{"type":"REPORT","url":"https://bugzilla.suse.com/1019550"},{"type":"REPORT","url":"https://bugzilla.suse.com/1019568"},{"type":"REPORT","url":"https://bugzilla.suse.com/1019570"},{"type":"REPORT","url":"https://bugzilla.suse.com/1022219"},{"type":"REPORT","url":"https://bugzilla.suse.com/1022255"},{"type":"REPORT","url":"https://bugzilla.suse.com/1022257"},{"type":"REPORT","url":"https://bugzilla.suse.com/1022260"},{"type":"REPORT","url":"https://bugzilla.suse.com/1022262"},{"type":"REPORT","url":"https://bugzilla.suse.com/1022263"},{"type":"REPORT","url":"https://bugzilla.suse.com/1022264"},{"type":"REPORT","url":"https://bugzilla.suse.com/1022265"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-10158"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-10159"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-10160"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-10161"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-10162"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-10166"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-10167"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-10168"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-7478"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-7479"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-7480"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2016-9138"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2017-5340"}],"related":["CVE-2016-10158","CVE-2016-10159","CVE-2016-10160","CVE-2016-10161","CVE-2016-10162","CVE-2016-10166","CVE-2016-10167","CVE-2016-10168","CVE-2016-7478","CVE-2016-7479","CVE-2016-7480","CVE-2016-9138","CVE-2017-5340"],"summary":"Security update for php7","upstream":["CVE-2016-10158","CVE-2016-10159","CVE-2016-10160","CVE-2016-10161","CVE-2016-10162","CVE-2016-10166","CVE-2016-10167","CVE-2016-10168","CVE-2016-7478","CVE-2016-7479","CVE-2016-7480","CVE-2016-9138","CVE-2017-5340"]}