From cbf33e00e2bc74c125b5cfa97a1a57f89eca627b Mon Sep 17 00:00:00 2001 From: Remi Collet Date: Tue, 22 Oct 2019 14:33:04 +0200 Subject: Fix CVE-2019-11043 env_path_info underflow in fpm_main.c --- php.spec | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'php.spec') diff --git a/php.spec b/php.spec index ea9787e..3491626 100644 --- a/php.spec +++ b/php.spec @@ -140,7 +140,7 @@ Summary: PHP scripting language for creating dynamic web sites Name: %{?scl_prefix}php Version: 5.5.38 -Release: 11%{?dist} +Release: 12%{?dist} # All files licensed under PHP version 3.01, except # Zend is licensed under Zend # TSRM is licensed under BSD @@ -255,6 +255,7 @@ Patch159: bug77020.patch Patch160: bug77231.patch Patch161: bug77242.patch Patch162: bug77380.patch +Patch163: bug78599.patch # Security fixes (200+) @@ -1010,6 +1011,7 @@ support for using the enchant library to PHP. %patch160 -p1 -b .bug77231 %patch161 -p1 -b .bug77242 %patch162 -p1 -b .bug77380 +%patch163 -p1 -b .bug78599 : ------------------------ @@ -1748,7 +1750,7 @@ cat << EOF Even, if this package includes some security fix, backported from 5.6, The UPGRADE to a maintained version is very strongly RECOMMENDED. -%if %{?fedora}%{!?fedora:99} < 26 +%if %{?fedora}%{!?fedora:99} < 28 WARNING : Fedora %{fedora} is now EOL : You should consider upgrading to a supported release %endif @@ -1922,6 +1924,10 @@ EOF %changelog +* Tue Oct 22 2019 Remi Collet - 5.5.38-12 +- FPM: + Fix CVE-2019-11043 env_path_info underflow in fpm_main.c + * Fri Jan 11 2019 Remi Collet - 5.5.38-11 - Fix #77242 heap out of bounds read in xmlrpc_decode - Fix #77380 Global out of bounds read in xmlrpc base64 code -- cgit