Publishing details

Changelog

xmlrpc-epi (0.54.2-1+deb7u1ubuntu0.14.04.2) trusty-security; urgency=medium

  * Security merge from Debian
    - directly applied d/p/CVE-2016-6296.patch

xmlrpc-epi (0.54.2-1+deb7u1) wheezy-security; urgency=high

  * Non-maintainer upload by the Wheezy LTS Team.
  * CVE-2016-6296.patch
    Integer signedness error in the simplestring_addn function in
    simplestring.c in xmlrpc-epi through 0.54.2, as used in PHP
    before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, allows
    remote attackers to cause a denial of service (heap-based buffer
    overflow) or possibly have unspecified other impact via a long
    first argument to the PHP xmlrpc_encode_request function.

 -- Steve Beattie <email address hidden>  Fri, 19 Aug 2016 12:15:18 -0700

Available diffs

Builds

Built packages

Package files