From 0c1009e782676a99d57a5e1584ea3cbfb5e7476c Mon Sep 17 00:00:00 2001 From: Remi Collet Date: Tue, 28 May 2019 11:01:40 +0200 Subject: - iconv: Fix #78069 Out-of-bounds read in iconv.c:_php_iconv_mime_decode() CVE-2019-11039 - exif: Fix #77988 Heap-buffer-overflow on php_jpg_get16 CVE-2019-11040 - sqlite3: Fix #77967 Bypassing open_basedir restrictions via file uris --- failed.txt | 6 ++++-- php-bug77967.patch | 57 ++++++++++++++++++++++++++++++++++++++++++++++++++++ php-bug77988.patch | 59 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ php-bug78069.patch | 36 +++++++++++++++++++++++++++++++++ php56.spec | 18 ++++++++++++++++- 5 files changed, 173 insertions(+), 3 deletions(-) create mode 100644 php-bug77967.patch create mode 100644 php-bug77988.patch create mode 100644 php-bug78069.patch diff --git a/failed.txt b/failed.txt index 3762584..023e9a8 100644 --- a/failed.txt +++ b/failed.txt @@ -1,8 +1,8 @@ -===== 5.6.40-8 (2019-04-30) +===== 5.6.40-9 (2019-05-28) $ grep -r 'Tests failed' /var/lib/mock/*/build.log -/var/lib/mock/el6i/build.log:Tests failed : 2 +/var/lib/mock/el6i/build.log:Tests failed : 4 /var/lib/mock/el6x/build.log:Tests failed : 0 /var/lib/mock/el7x/build.log:Tests failed : 0 @@ -10,6 +10,8 @@ $ grep -r 'Tests failed' /var/lib/mock/*/build.log el6i: 4 Test date_sunrise() function : usage variation - Passing high positive and negative float values to time argument. [ext/date/tests/date_sunrise_variation9.phpt] 4 Test getdate() function : usage variation - Passing high positive and negative float values to timestamp. [ext/date/tests/getdate_variation7.phpt] + Peer verification enabled for client streams [ext/openssl/tests/peer_verification.phpt] + Peer verification matches SAN names [ext/openssl/tests/san_peer_matching.phpt] 1 proc_open have erratic results... :( diff --git a/php-bug77967.patch b/php-bug77967.patch new file mode 100644 index 0000000..dad8585 --- /dev/null +++ b/php-bug77967.patch @@ -0,0 +1,57 @@ +From 7de8c0284cd9e237eb8a1faa9b41af1d3ef32ea9 Mon Sep 17 00:00:00 2001 +From: Stanislav Malyshev +Date: Mon, 27 May 2019 18:04:00 -0700 +Subject: [PATCH] Fix bug #77967 - Bypassing open_basedir restrictions via file + uris + +(cherry picked from commit c34895e837b50213c2bb201c612904342d2bd216) +--- + NEWS | 7 +++++-- + ext/sqlite3/sqlite3.c | 9 +++++++++ + 2 files changed, 14 insertions(+), 2 deletions(-) + +diff --git a/NEWS b/NEWS +index 9345c039a2..cff9517ed5 100644 +--- a/NEWS ++++ b/NEWS +@@ -15,6 +15,9 @@ Backported from 7.1.30 + . Fixed bug #78069 (Out-of-bounds read in iconv.c:_php_iconv_mime_decode() + due to integer overflow). (CVE-2019-11039). (maris dot adam) + ++- SQLite: ++ . Fixed bug #77967 (Bypassing open_basedir restrictions via file uris). (Stas) ++ + Backported from 7.1.29 + + - EXIF +@@ -26,8 +29,8 @@ Backported from 7.1.28 + - EXIF: + . Fixed bug #77753 (Heap-buffer-overflow in php_ifd_get32s). (CVE-2019-11034) + (Stas) +- . Fixed bug #77831 (Heap-buffer-overflow in exif_iif_add_value). +- (CVE-2019-11035) (Stas) ++ . Fixed bug #77831 (Heap-buffer-overflow in exif_iif_add_value). ++ (CVE-2019-11035) (Stas) + + - SQLite3: + . Added sqlite3.defensive INI directive. (BohwaZ) +diff --git a/ext/sqlite3/sqlite3.c b/ext/sqlite3/sqlite3.c +index 761b777d06..7bf873ff69 100644 +--- a/ext/sqlite3/sqlite3.c ++++ b/ext/sqlite3/sqlite3.c +@@ -2062,6 +2062,15 @@ static int php_sqlite3_authorizer(void *autharg, int access_type, const char *ar + } + #endif + ++ if (strncmp(arg3, "file:", 5) == 0) { ++ /* starts with "file:" */ ++ if (!arg3[5]) { ++ return SQLITE_DENY; ++ } ++ if (php_check_open_basedir(arg3 + 5 TSRMLS_CC)) { ++ return SQLITE_DENY; ++ } ++ } + if (php_check_open_basedir(arg3 TSRMLS_CC)) { + return SQLITE_DENY; + } diff --git a/php-bug77988.patch b/php-bug77988.patch new file mode 100644 index 0000000..bd7fa14 --- /dev/null +++ b/php-bug77988.patch @@ -0,0 +1,59 @@ +Without test as binary patch not supported + + + + +From 9e0574adfd9566ed6308291e4917b095a238fa79 Mon Sep 17 00:00:00 2001 +From: Stanislav Malyshev +Date: Mon, 27 May 2019 17:16:29 -0700 +Subject: [PATCH] Fix bug #77988 - heap-buffer-overflow on php_jpg_get16 + +(cherry picked from commit 73ff4193be24192c894dc0502d06e2b2db35eefb) +--- + NEWS | 14 ++++++++++++++ + ext/exif/exif.c | 2 ++ + ext/exif/tests/bug77988.jpg | Bin 0 -> 1202 bytes + ext/exif/tests/bug77988.phpt | 11 +++++++++++ + 4 files changed, 27 insertions(+) + create mode 100644 ext/exif/tests/bug77988.jpg + create mode 100644 ext/exif/tests/bug77988.phpt + +diff --git a/NEWS b/NEWS +index 1bb6b57584..9345c039a2 100644 +--- a/NEWS ++++ b/NEWS +@@ -1,6 +1,20 @@ + PHP NEWS + ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| + ++Backported from 7.1.30 ++ ++- EXIF: ++ . Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16). ++ (CVE-2019-11040) (Stas) ++ ++- GD: ++ . Fixed bug #77973 (Uninitialized read in gdImageCreateFromXbm). ++ (CVE-2019-11038) (cmb) ++ ++- Iconv: ++ . Fixed bug #78069 (Out-of-bounds read in iconv.c:_php_iconv_mime_decode() ++ due to integer overflow). (CVE-2019-11039). (maris dot adam) ++ + Backported from 7.1.29 + + - EXIF +diff --git a/ext/exif/exif.c b/ext/exif/exif.c +index 15e091b6c5..b6c31773ab 100644 +--- a/ext/exif/exif.c ++++ b/ext/exif/exif.c +@@ -3536,6 +3536,8 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo TSRMLS_DC) + if (c == 0xFF) + return FALSE; + marker = c; ++ if (pos>=ImageInfo->Thumbnail.size) ++ return FALSE; + length = php_jpg_get16(data+pos); + if (length > ImageInfo->Thumbnail.size || pos >= ImageInfo->Thumbnail.size - length) { + return FALSE; + diff --git a/php-bug78069.patch b/php-bug78069.patch new file mode 100644 index 0000000..583db1d --- /dev/null +++ b/php-bug78069.patch @@ -0,0 +1,36 @@ +Without test as binary patch not supported + + + + +From aabd02d6dd1eab180486cff933dc8d08d4297e38 Mon Sep 17 00:00:00 2001 +From: Stanislav Malyshev +Date: Mon, 27 May 2019 16:32:42 -0700 +Subject: [PATCH] Fix bug #78069 - Out-of-bounds read in + iconv.c:_php_iconv_mime_decode() due to integer overflow + +(cherry picked from commit 7cf7148a8f8f4f55fb04de2a517d740bb6253eac) +--- + ext/iconv/iconv.c | 4 +++- + ext/iconv/tests/bug78069.data | Bin 0 -> 107 bytes + ext/iconv/tests/bug78069.phpt | 15 +++++++++++++++ + 3 files changed, 18 insertions(+), 1 deletion(-) + create mode 100644 ext/iconv/tests/bug78069.data + create mode 100644 ext/iconv/tests/bug78069.phpt + +diff --git a/ext/iconv/iconv.c b/ext/iconv/iconv.c +index 335dbd17e9..bbc4b0f5e3 100644 +--- a/ext/iconv/iconv.c ++++ b/ext/iconv/iconv.c +@@ -1645,7 +1645,9 @@ static php_iconv_err_t _php_iconv_mime_decode(smart_str *pretval, const char *st + * we can do at this point. */ + if (*(p1 + 1) == '=') { + ++p1; +- --str_left; ++ if (str_left > 1) { ++ --str_left; ++ } + } + + err = _php_iconv_appendl(pretval, encoded_word, (size_t)((p1 + 1) - encoded_word), cd_pl); + diff --git a/php56.spec b/php56.spec index 109172b..842c940 100644 --- a/php56.spec +++ b/php56.spec @@ -142,7 +142,7 @@ Summary: PHP scripting language for creating dynamic web sites Name: php Version: 5.6.40 -Release: 8%{?dist} +Release: 9%{?dist} # All files licensed under PHP version 3.01, except # Zend is licensed under Zend # TSRM is licensed under BSD @@ -216,6 +216,9 @@ Patch215: php-sqlite3-defensive.patch Patch216: php-bug77753.patch Patch217: php-bug77831.patch Patch218: php-bug77950.patch +Patch219: php-bug78069.patch +Patch220: php-bug77988.patch +Patch221: php-bug77967.patch # Fixes for tests (300+) # Factory is droped from system tzdata @@ -993,6 +996,9 @@ echo CIBLE = %{name}-%{version}-%{release} oci8=%{with_oci8} libzip=%{with_libzi %patch216 -p1 -b .bug77753 %patch217 -p1 -b .bug77831 %patch218 -p1 -b .bug77950 +%patch219 -p1 -b .bug78069 +%patch220 -p1 -b .bug77988 +%patch221 -p1 -b .bug77967 # Fixes for tests %patch300 -p1 -b .datetests @@ -2045,6 +2051,16 @@ EOF %changelog +* Tue May 28 2019 Remi Collet - 5.6.40-9 +- iconv: + Fix #78069 Out-of-bounds read in iconv.c:_php_iconv_mime_decode() + CVE-2019-11039 +- exif: + Fix #77988 Heap-buffer-overflow on php_jpg_get16 + CVE-2019-11040 +- sqlite3: + Fix #77967 Bypassing open_basedir restrictions via file uris + * Tue Apr 30 2019 Remi Collet - 5.6.40-8 - exif: Fix #77950 Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG -- cgit