--- title: 'USN-3600-1: PHP vulnerabilities | Ubuntu security notices' description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/notices/USN-3600-1 --- 1. [Ubuntu Security Notices](https://ubuntu.com/security/notices) 2. USN-3600-1 --- # USN-3600-1: PHP vulnerabilities Publication date 19 March 2018 Overview Several security issues were fixed in PHP. Releases [17.10](https://ubuntu.com/security/notices?release=artful) [16.04 LTS](https://ubuntu.com/security/notices?release=xenial) [14.04 LTS](https://ubuntu.com/security/notices?release=trusty) --- Open side navigation ## Packages * [php5](https://ubuntu.com/security/cves?package=php5) - HTML-embedded scripting language interpreter * [php7.0](https://ubuntu.com/security/cves?package=php7.0) - HTML-embedded scripting language interpreter * [php7.1](https://ubuntu.com/security/cves?package=php7.1) - HTML-embedded scripting language interpreter ## Details It was discovered that PHP incorrectly handled certain stream metadata. A remote attacker could possibly use this issue to set arbitrary metadata. This issue only affected Ubuntu 14.04 LTS. ([CVE-2016-10712](https://ubuntu.com/security/CVE-2016-10712)) It was discovered that PHP incorrectly handled the PHAR 404 error page. A remote attacker could possibly use this issue to conduct cross-site scripting (XSS) attacks. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10. ([CVE-2018-5712](https://ubuntu.com/security/CVE-2018-5712)) It was discovered that PHP incorrectly handled parsing certain HTTP responses. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. ([CVE-2018-7584](https://ubuntu.com/security/CVE-2018-7584)) ## Update instructions In Ubuntu 16.04 LTS and Ubuntu 17.10, this update uses a new upstream release, which includes additional bug fixes. In general, a standard system update will make all the necessary changes. [Learn more about how to get the fixes.](https://ubuntu.com/security/cves/about#security) The problem can be corrected by updating your system to the following package versions: | Ubuntu Release | Package Version | | --- | --- | | 17.10 artful | [libapache2-mod-php7.1](https://launchpad.net/ubuntu/+source/php7.1) –  [7.1.15-0ubuntu0.17.10.1](https://launchpad.net/ubuntu/+source/php7.1/7.1.15-0ubuntu0.17.10.1) | | | | [php7.1-cgi](https://launchpad.net/ubuntu/+source/php7.1) –  [7.1.15-0ubuntu0.17.10.1](https://launchpad.net/ubuntu/+source/php7.1/7.1.15-0ubuntu0.17.10.1) | | | | [php7.1-cli](https://launchpad.net/ubuntu/+source/php7.1) –  [7.1.15-0ubuntu0.17.10.1](https://launchpad.net/ubuntu/+source/php7.1/7.1.15-0ubuntu0.17.10.1) | | | | [php7.1-fpm](https://launchpad.net/ubuntu/+source/php7.1) –  [7.1.15-0ubuntu0.17.10.1](https://launchpad.net/ubuntu/+source/php7.1/7.1.15-0ubuntu0.17.10.1) | | | | 16.04 LTS xenial | [libapache2-mod-php7.0](https://launchpad.net/ubuntu/+source/php7.0) –  [7.0.28-0ubuntu0.16.04.1](https://launchpad.net/ubuntu/+source/php7.0/7.0.28-0ubuntu0.16.04.1) | | | | [php7.0-cgi](https://launchpad.net/ubuntu/+source/php7.0) –  [7.0.28-0ubuntu0.16.04.1](https://launchpad.net/ubuntu/+source/php7.0/7.0.28-0ubuntu0.16.04.1) | | | | [php7.0-cli](https://launchpad.net/ubuntu/+source/php7.0) –  [7.0.28-0ubuntu0.16.04.1](https://launchpad.net/ubuntu/+source/php7.0/7.0.28-0ubuntu0.16.04.1) | | | | [php7.0-fpm](https://launchpad.net/ubuntu/+source/php7.0) –  [7.0.28-0ubuntu0.16.04.1](https://launchpad.net/ubuntu/+source/php7.0/7.0.28-0ubuntu0.16.04.1) | | | | 14.04 LTS trusty | [libapache2-mod-php5](https://launchpad.net/ubuntu/+source/php5) –  [5.5.9+dfsg-1ubuntu4.24](https://launchpad.net/ubuntu/+source/php5/5.5.9+dfsg-1ubuntu4.24) | | | | [php5-cgi](https://launchpad.net/ubuntu/+source/php5) –  [5.5.9+dfsg-1ubuntu4.24](https://launchpad.net/ubuntu/+source/php5/5.5.9+dfsg-1ubuntu4.24) | | | | [php5-cli](https://launchpad.net/ubuntu/+source/php5) –  [5.5.9+dfsg-1ubuntu4.24](https://launchpad.net/ubuntu/+source/php5/5.5.9+dfsg-1ubuntu4.24) | | | | [php5-fpm](https://launchpad.net/ubuntu/+source/php5) –  [5.5.9+dfsg-1ubuntu4.24](https://launchpad.net/ubuntu/+source/php5/5.5.9+dfsg-1ubuntu4.24) | | | --- ### Reduce your security exposure Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines. [Get Ubuntu Pro](https://ubuntu.com/pro) ## References * [CVE-2018-7584](https://ubuntu.com/security/CVE-2018-7584) * [CVE-2018-5712](https://ubuntu.com/security/CVE-2018-5712) * [CVE-2016-10712](https://ubuntu.com/security/CVE-2016-10712) ## Related notices * [USN-3600-2](https://ubuntu.com/security/notices/USN-3600-2) * [USN-3566-2](https://ubuntu.com/security/notices/USN-3566-2) * [USN-3566-1](https://ubuntu.com/security/notices/USN-3566-1)