Peter Korsgaard 91f4c9d412 php: security bump to version 7.1.7 ... Fixes the following security issues: CVE-2017-7890 - Buffer over-read into uninitialized memory. The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c (which can be reached with a call to the imagecreatefromstring() function) uses constant-sized color tables of size 3 * 256, but does not zero-out these arrays before use. CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229 - Out-of-bonds access in oniguruma regexp library. CVE-2017-11144 - In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission. CVE-2017-11145 - In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, lack of a bounds check in the date extension's timelib_meridian parsing code could be used by attackers able to supply date strings to leak information from the interpreter, related to an ext/date/lib/parse_date.c out-of-bounds read affecting the php_parse_date function. CVE-2017-11146 - In PHP through 5.6.31, 7.x through 7.0.21, and 7.1.x through 7.1.7, lack of bounds checks in the date extension's timelib_meridian parsing code could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-11145. While we're at it, add a hash for the license file. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>		2017-07-11 21:30:52 +02:00
..
0001-acinclude.m4-don-t-unset-variables.patch
0002-iconv-tweak-iconv-detection.patch
0003-configure-disable-the-phar-tool.patch
0004-OPcache-flock-mechanism-is-obviously-linux-so-force-.patch
0005-ext-fileinfo-config.m4-allow-cache-answer-for-strcas.patch
0007-avoid-bfin-gcc-segfault.patch
0008-fix-asm-constraints-in-aarch64-multiply-macro.patch
0009-Call-apxs-with-correct-prefix.patch
Config.ext	php: use the new gettext logic	2017-07-05 01:34:03 +02:00
Config.in
php-fpm.conf
php.hash	php: security bump to version 7.1.7	2017-07-11 21:30:52 +02:00
php.mk	php: security bump to version 7.1.7	2017-07-11 21:30:52 +02:00