--- title: 'USN-2254-1: PHP vulnerabilities | Ubuntu security notices' description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/notices/USN-2254-1 --- 1. [Ubuntu Security Notices](https://ubuntu.com/security/notices) 2. USN-2254-1 --- # USN-2254-1: PHP vulnerabilities Publication date 23 June 2014 Overview Several security issues were fixed in PHP. Releases [14.04 LTS](https://ubuntu.com/security/notices?release=trusty) [13.10](https://ubuntu.com/security/notices?release=saucy) [12.04](https://ubuntu.com/security/notices?release=precise) [10.04](https://ubuntu.com/security/notices?release=lucid) --- Open side navigation ## Packages * [php5](https://ubuntu.com/security/cves?package=php5) - HTML-embedded scripting language interpreter ## Details Christian Hoffmann discovered that the PHP FastCGI Process Manager (FPM) set incorrect permissions on the UNIX socket. A local attacker could use this issue to possibly elevate their privileges. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and Ubuntu 14.04 LTS. ([CVE-2014-0185](https://ubuntu.com/security/CVE-2014-0185)) Francisco Alonso discovered that the PHP Fileinfo component incorrectly handled certain CDF documents. A remote attacker could use this issue to cause PHP to hang or crash, resulting in a denial of service. ([CVE-2014-0237](https://ubuntu.com/security/CVE-2014-0237), [CVE-2014-0238](https://ubuntu.com/security/CVE-2014-0238)) Stefan Esser discovered that PHP incorrectly handled DNS TXT records. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. ([CVE-2014-4049](https://ubuntu.com/security/CVE-2014-4049)) ## Update instructions In general, a standard system update will make all the necessary changes. [Learn more about how to get the fixes.](https://ubuntu.com/security/cves/about#security) The problem can be corrected by updating your system to the following package versions: | Ubuntu Release | Package Version | | --- | --- | | 14.04 LTS trusty | [libapache2-mod-php5](https://launchpad.net/ubuntu/+source/php5) –  [5.5.9+dfsg-1ubuntu4.1](https://launchpad.net/ubuntu/+source/php5/5.5.9+dfsg-1ubuntu4.1) | | | | [php5-cgi](https://launchpad.net/ubuntu/+source/php5) –  [5.5.9+dfsg-1ubuntu4.1](https://launchpad.net/ubuntu/+source/php5/5.5.9+dfsg-1ubuntu4.1) | | | | [php5-cli](https://launchpad.net/ubuntu/+source/php5) –  [5.5.9+dfsg-1ubuntu4.1](https://launchpad.net/ubuntu/+source/php5/5.5.9+dfsg-1ubuntu4.1) | | | | [php5-fpm](https://launchpad.net/ubuntu/+source/php5) –  [5.5.9+dfsg-1ubuntu4.1](https://launchpad.net/ubuntu/+source/php5/5.5.9+dfsg-1ubuntu4.1) | | | | 13.10 saucy | [libapache2-mod-php5](https://launchpad.net/ubuntu/+source/php5) –  [5.5.3+dfsg-1ubuntu2.4](https://launchpad.net/ubuntu/+source/php5/5.5.3+dfsg-1ubuntu2.4) | | | | [php5-cgi](https://launchpad.net/ubuntu/+source/php5) –  [5.5.3+dfsg-1ubuntu2.4](https://launchpad.net/ubuntu/+source/php5/5.5.3+dfsg-1ubuntu2.4) | | | | [php5-cli](https://launchpad.net/ubuntu/+source/php5) –  [5.5.3+dfsg-1ubuntu2.4](https://launchpad.net/ubuntu/+source/php5/5.5.3+dfsg-1ubuntu2.4) | | | | [php5-fpm](https://launchpad.net/ubuntu/+source/php5) –  [5.5.3+dfsg-1ubuntu2.4](https://launchpad.net/ubuntu/+source/php5/5.5.3+dfsg-1ubuntu2.4) | | | | 12.04 precise | [libapache2-mod-php5](https://launchpad.net/ubuntu/+source/php5) –  [5.3.10-1ubuntu3.12](https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.12) | | | | [php5-cgi](https://launchpad.net/ubuntu/+source/php5) –  [5.3.10-1ubuntu3.12](https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.12) | | | | [php5-cli](https://launchpad.net/ubuntu/+source/php5) –  [5.3.10-1ubuntu3.12](https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.12) | | | | [php5-fpm](https://launchpad.net/ubuntu/+source/php5) –  [5.3.10-1ubuntu3.12](https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.12) | | | | 10.04 lucid | [libapache2-mod-php5](https://launchpad.net/ubuntu/+source/php5) –  [5.3.2-1ubuntu4.25](https://launchpad.net/ubuntu/+source/php5/5.3.2-1ubuntu4.25) | | | | [php5-cgi](https://launchpad.net/ubuntu/+source/php5) –  [5.3.2-1ubuntu4.25](https://launchpad.net/ubuntu/+source/php5/5.3.2-1ubuntu4.25) | | | | [php5-cli](https://launchpad.net/ubuntu/+source/php5) –  [5.3.2-1ubuntu4.25](https://launchpad.net/ubuntu/+source/php5/5.3.2-1ubuntu4.25) | | | --- ### Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines. [Get Ubuntu Pro](https://ubuntu.com/pro) ## References * [CVE-2014-4049](https://ubuntu.com/security/CVE-2014-4049) * [CVE-2014-0238](https://ubuntu.com/security/CVE-2014-0238) * [CVE-2014-0237](https://ubuntu.com/security/CVE-2014-0237) * [CVE-2014-0185](https://ubuntu.com/security/CVE-2014-0185)