RHSA-2018:1296: Moderate: rh-php70-php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.<br>The following packages have been upgraded to a later upstream version: rh-php70-php (7.0.27). (BZ#1518843)<br>Security Fix(es):<br><li> php: Heap overflow in mysqlnd when not receiving UNSIGNEDFLAG in BIT field (CVE-2016-7412)</li> <li> php: Use after free in wddxdeserialize (CVE-2016-7413)</li> <li> php: Out of bounds heap read when verifying signature of zip phar in pharparsezipfile (CVE-2016-7414)</li> <li> php: Stack based buffer overflow in msgfmtformatmessage (CVE-2016-7416)</li> <li> php: Missing type check when unserializing SplArray (CVE-2016-7417)</li> <li> php: Null pointer dereference in phpwddxpushelement (CVE-2016-7418)</li> <li> php: Use-after-free vulnerability when resizing the 'properties' hash table of a serialized object (CVE-2016-7479)</li> <li> php: Invalid read when wddx decodes empty boolean element (CVE-2016-9935)</li> <li> php: Use After Free in unserialize() (CVE-2016-9936)</li> <li> php: Wrong calculation in exifconvertanytoint function (CVE-2016-10158)</li> <li> php: Integer overflow in pharparsepharfile (CVE-2016-10159)</li> <li> php: Off-by-one error in pharparsepharfile when loading crafted phar archive (CVE-2016-10160)</li> <li> php: Out-of-bounds heap read on unserialize in finishnesteddata() (CVE-2016-10161)</li> <li> php: Null pointer dereference when unserializing PHP object (CVE-2016-10162)</li> <li> gd: DoS vulnerability in gdImageCreateFromGd2Ctx() (CVE-2016-10167)</li> <li> gd: Integer overflow in gdio.c (CVE-2016-10168)</li> <li> php: Use of uninitialized memory in unserialize() (CVE-2017-5340)</li> <li> php: Buffer over-read from unitialized data in gdImageCreateFromGifCtx function (CVE-2017-7890)</li> <li> oniguruma: Out-of-bounds stack read in matchat() during regular expression searching (CVE-2017-9224)</li> <li> oniguruma: Heap buffer overflow in nextstateval() during regular expression compilation (CVE-2017-9226)</li> <li> oniguruma: Out-of-bounds stack read in mbcenclen() during regular expression searching (CVE-2017-9227)</li> <li> oniguruma: Out-of-bounds heap write in bitsetsetrange() (CVE-2017-9228)</li> <li> oniguruma: Invalid pointer dereference in leftadjustcharhead() (CVE-2017-9229)</li> <li> php: Incorrect WDDX deserialization of boolean parameters leads to DoS (CVE-2017-11143)</li> <li> php: Incorrect return value check of OpenSSL sealing function leads to crash (CVE-2017-11144)</li> <li> php: Out-of-bounds read in pharparsepharfile (CVE-2017-11147)</li> <li> php: Stack-based buffer over-read in msgfmtparsemessage function (CVE-2017-11362)</li> <li> php: Stack based 1-byte buffer over-write in zendinidoop() function Zend/zendiniparser.c (CVE-2017-11628)</li> <li> php: heap use after free in ext/standard/varunserializer.re (CVE-2017-12932)</li> <li> php: heap use after free in ext/standard/varunserializer.re (CVE-2017-12934)</li> <li> php: reflected XSS in .phar 404 page (CVE-2018-5712)</li> <li> php, gd: Stack overflow in gdImageFillToBorder on truecolor images (CVE-2016-9933)</li> <li> php: NULL Pointer Dereference in WDDX Packet Deserialization with PDORow (CVE-2016-9934)</li> <li> php: wddxdeserialize() heap out-of-bound read via phpparsedate() (CVE-2017-11145)</li> <li> php: buffer over-read in finishnesteddata function (CVE-2017-12933)</li> <li> php: Out-of-bound read in timelibmeridian() (CVE-2017-16642)</li> <li> php: Denial of Service (DoS) via infinite loop in libgd gdImageCreateFromGifCtx function in ext/gd/libgd/gdgifin.c (CVE-2018-5711)</li> For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.<br>Additional Changes:<br>For details, see the Red Hat Software Collections 3.1 Release Notes linked from the References section.