-
php7.0 (7.0.18-0ubuntu0.16.10.1) yakkety; urgency=medium
* New upstream release 7.0.18
- LP: #1686237
- LP: #1674892
- Refresh patches for new upstream release
* Drop:
- debian/patches/0048-Fix-pdo_pgsql.patch: Fixed #73959 - lastInsertId
fails to throw an exception in pdsql. Thanks to andrewnester
<email address hidden>. Closes LP #1658289.
[ Fixed upstream in 7.0.16 ]
- SECURITY REGRESSION: large mysql requests broken (LP #1668017)
+ debian/patches/fix_74021.patch: fix fetch_array with more than
MEDIUMBLOB in ext/mysqlnd/mysqlnd_wireprotocol.c, added tests to
ext/mysqli/tests/bug73800.phpt, ext/mysqli/tests/bug74021.phpt.
[ Fixed upstream in 7.0.17 ]
-- Nishanth Aravamudan <email address hidden> Wed, 26 Apr 2017 16:55:19 -0700
-
php7.0 (7.0.15-0ubuntu0.16.10.4) yakkety-security; urgency=medium
* SECURITY REGRESSION: large mysql requests broken (LP: #1668017)
- debian/patches/fix_74021.patch: fix fetch_array with more than
MEDIUMBLOB in ext/mysqlnd/mysqlnd_wireprotocol.c, added tests to
ext/mysqli/tests/bug73800.phpt, ext/mysqli/tests/bug74021.phpt.
-- Marc Deslauriers <email address hidden> Wed, 01 Mar 2017 10:50:27 -0500
-
php7.0 (7.0.15-0ubuntu0.16.10.3) yakkety; urgency=medium
* debian/patches/fix_74021.patch: Fix fetch_array with more than
MEDIUMBLOB. Thanks to andrewnester <email address hidden>.
Closes LP: #1668017.
-- Nishanth Aravamudan <email address hidden> Tue, 28 Feb 2017 13:20:57 -0800
-
php7.0 (7.0.15-0ubuntu0.16.10.2) yakkety-security; urgency=medium
* No change rebuild in the -security pocket.
-- Marc Deslauriers <email address hidden> Thu, 23 Feb 2017 08:42:19 -0500
-
php7.0 (7.0.15-0ubuntu0.16.10.1) yakkety; urgency=medium
* New upstream release
- LP: #1663405
- Refresh patches for new upstream release.
* debian/patches/0048-Fix-pdo_pgsql.patch: Fixed #73959 - lastInsertId
fails to throw an exception in pdsql. Thanks to andrewnester
<email address hidden>. Closes LP: #1658289.
-- Nishanth Aravamudan <email address hidden> Tue, 14 Feb 2017 14:44:43 -0800
-
php7.0 (7.0.13-0ubuntu0.16.10.1) yakkety; urgency=medium
* New upstream release
- LP: #1645431
- Refresh patches for new upstream release.
* Drop:
- SECURITY UPDATE: proxy request header vulnerability (httpoxy)
+ debian/patches/CVE-2016-5385.patch: only use HTTP_PROXY from the
local environment in ext/standard/basic_functions.c, main/SAPI.c,
main/php_variables.c.
+ CVE-2016-5385
[ Fixed in 7.0.9 ]
- SECURITY UPDATE: inadequate error handling in bzread()
+ debian/patches/CVE-2016-5399.patch: do not allow reading past error
read in ext/bz2/bz2.c.
+ CVE-2016-5399
[ Fixed in 7.0.9 ]
- SECURITY UPDATE: integer overflow in the virtual_file_ex function
+ debian/patches/CVE-2016-6289.patch: properly check path_length in
Zend/zend_virtual_cwd.c.
+ CVE-2016-6289
[ Fixed in 7.0.9 ]
- SECURITY UPDATE: use after free in unserialize() with unexpected
session deserialization
+ debian/patches/CVE-2016-6290.patch: destroy var_hash properly in
ext/session/session.c, added test to ext/session/tests/bug72562.phpt.
+ CVE-2016-6290
[ Fixed in 7.0.9 ]
- SECURITY UPDATE: out of bounds read in exif_process_IFD_in_MAKERNOTE
+ debian/patches/CVE-2016-6291.patch: add more bounds checks to
ext/exif/exif.c.
+ CVE-2016-6291
[ Fixed in 7.0.9 ]
- SECURITY UPDATE: NULL pointer dereference in exif_process_user_comment
+ debian/patches/CVE-2016-6292.patch: properly handle encoding in
ext/exif/exif.c.
+ CVE-2016-6292
[ Fixed in 7.0.9 ]
- SECURITY UPDATE: locale_accept_from_http out-of-bounds access
+ debian/patches/CVE-2016-6294.patch: check length in
ext/intl/locale/locale_methods.c, added test to
ext/intl/tests/bug72533.phpt.
+ CVE-2016-6294
[ Fixed in 7.0.9 ]
- SECURITY UPDATE: use after free vulnerability in SNMP with GC and
unserialize()
+ debian/patches/CVE-2016-6295.patch: add new handler to
ext/snmp/snmp.c, add test to ext/snmp/tests/bug72479.phpt.
+ CVE-2016-6295
[ Fixed in 7.0.9 ]
- SECURITY UPDATE: heap buffer overflow in simplestring_addn
+ debian/patches/CVE-2016-6296.patch: prevent overflows in
ext/xmlrpc/libxmlrpc/simplestring.*.
+ CVE-2016-6296
[ Fixed in 7.0.9 ]
- SECURITY UPDATE: integer overflow in php_stream_zip_opener
+ debian/patches/CVE-2016-6297.patch: use size_t in
ext/zip/zip_stream.c.
+ CVE-2016-6297
[ Fixed in 7.0.9 ]
- debian/patches/fix_exif_tests.patch: fix exif test results after
security changes.
[ Fixed in 7.0.9 ]
- SECURITY UPDATE: denial of service or code execution via crafted
serialized data
+ debian/patches/CVE-2016-7124.patch: fix unserializing logic in
ext/session/session.c, ext/standard/var_unserializer.c*,
ext/wddx/wddx.c, added tests to
ext/standard/tests/serialize/bug72663.phpt,
ext/standard/tests/serialize/bug72663_2.phpt,
ext/standard/tests/serialize/bug72663_3.phpt.
+ CVE-2016-7124
[ Fixed in 7.0.10 ]
- SECURITY UPDATE: arbitrary-type session data injection
+ debian/patches/CVE-2016-7125.patch: consume data even if not storing
in ext/session/session.c, added test to
ext/session/tests/bug72681.phpt.
+ CVE-2016-7125
[ Fixed in 7.0.10 ]
- SECURITY UPDATE: denial of service and possible code execution in
imagegammacorrect function
+ debian/patches/CVE-2016-7127.patch: check gamma values in
ext/gd/gd.c, added test to ext/gd/tests/bug72730.phpt.
+ CVE-2016-7127
[ Fixed in 7.0.10 ]
- SECURITY UPDATE: information disclosure via exif_process_IFD_in_TIFF
+ debian/patches/CVE-2016-7128.patch: properly handle thumbnails in
ext/exif/exif.c.
+ CVE-2016-7128
[ Fixed in 7.0.10 ]
- SECURITY UPDATE: denial of service and possible code execution via
invalid ISO 8601 time value
+ debian/patches/CVE-2016-7129.patch: properly handle strings in
ext/wddx/wddx.c, added test to ext/wddx/tests/bug72749.phpt.
+ CVE-2016-7129
[ Fixed in 7.0.10 ]
- SECURITY UPDATE: denial of service and possible code execution via
invalid base64 binary value
+ debian/patches/CVE-2016-7130.patch: properly handle string in
ext/wddx/wddx.c, added test to ext/wddx/tests/bug72750.phpt.
+ CVE-2016-7130
[ Fixed in 7.0.10 ]
- SECURITY UPDATE: denial of service and possible code execution via
malformed wddxPacket XML document
+ debian/patches/CVE-2016-7131.patch: added checks to ext/wddx/wddx.c,
added tests to ext/wddx/tests/bug72790.phpt,
ext/wddx/tests/bug72799.phpt.
+ CVE-2016-7131
+ CVE-2016-7132
[ Fixed in 7.0.10 ]
- SECURITY UPDATE: denial of service and possible code execution via
long pathname
+ debian/patches/CVE-2016-7133.patch: fix memory allocator in
Zend/zend_alloc.c.
+ CVE-2016-7133
[ Fixed in 7.0.10 ]
- SECURITY UPDATE: denial of service and possible code execution via
long string and curl_escape call
+ debian/patches/CVE-2016-7134.patch: check both curl_escape and
curl_unescape in ext/curl/interface.c.
+ CVE-2016-7134
[ Fixed in 7.0.10 ]
- SECURITY UPDATE: denial of service and possible code execution via
crafted field metadata in MySQL driver
+ debian/patches/CVE-2016-7412.patch: validate field length in
ext/mysqlnd/mysqlnd_wireprotocol.c.
+ CVE-2016-7412
[ Fixed in 7.0.11 ]
- SECURITY UPDATE: denial of service and possible code execution via
malformed wddxPacket XML document
+ debian/patches/CVE-2016-7413.patch: fixed use-after-free in
ext/wddx/wddx.c, added test to ext/wddx/tests/bug72860.phpt.
+ CVE-2016-7413
[ Fixed in 7.0.11 ]
- SECURITY UPDATE: denial of service and possible code execution via
crafted PHAR archive
+ debian/patches/CVE-2016-7414.patch: validate signatures in
ext/phar/util.c, ext/phar/zip.c.
+ CVE-2016-7414
[ Fixed in 7.0.11 ]
- SECURITY UPDATE: denial of service and possible code execution via
MessageFormatter::formatMessage call with a long first argument
+ debian/patches/CVE-2016-7416.patch: added locale length check to
ext/intl/msgformat/msgformat_format.c.
+ CVE-2016-7416
[ Fixed in 7.0.11 ]
- SECURITY UPDATE: denial of service or code execution via crafted
serialized data
+ debian/patches/CVE-2016-7417.patch: added type check to
ext/spl/spl_array.c, added test to ext/spl/tests/bug73029.phpt, fix
test in ext/spl/tests/bug70068.phpt.
+ CVE-2016-7417
[ Fixed in 7.0.11 ]
- SECURITY UPDATE: denial of service and possible code execution via
malformed wddxPacket XML document
+ debian/patches/CVE-2016-7418.patch: fix out-of-bounds read in
ext/wddx/wddx.c, added test to ext/wddx/tests/bug73065.phpt.
+ CVE-2016-7418
[ Fixed in 7.0.11 ]
-- Nishanth Aravamudan <email address hidden> Mon, 28 Nov 2016 12:14:42 -0800
-
php7.0 (7.0.8-3ubuntu3) yakkety; urgency=medium
* SECURITY UPDATE: denial of service or code execution via crafted
serialized data
- debian/patches/CVE-2016-7124.patch: fix unserializing logic in
ext/session/session.c, ext/standard/var_unserializer.c*,
ext/wddx/wddx.c, added tests to
ext/standard/tests/serialize/bug72663.phpt,
ext/standard/tests/serialize/bug72663_2.phpt,
ext/standard/tests/serialize/bug72663_3.phpt.
- CVE-2016-7124
* SECURITY UPDATE: arbitrary-type session data injection
- debian/patches/CVE-2016-7125.patch: consume data even if not storing
in ext/session/session.c, added test to
ext/session/tests/bug72681.phpt.
- CVE-2016-7125
* SECURITY UPDATE: denial of service and possible code execution in
imagegammacorrect function
- debian/patches/CVE-2016-7127.patch: check gamma values in
ext/gd/gd.c, added test to ext/gd/tests/bug72730.phpt.
- CVE-2016-7127
* SECURITY UPDATE: information disclosure via exif_process_IFD_in_TIFF
- debian/patches/CVE-2016-7128.patch: properly handle thumbnails in
ext/exif/exif.c.
- CVE-2016-7128
* SECURITY UPDATE: denial of service and possible code execution via
invalid ISO 8601 time value
- debian/patches/CVE-2016-7129.patch: properly handle strings in
ext/wddx/wddx.c, added test to ext/wddx/tests/bug72749.phpt.
- CVE-2016-7129
* SECURITY UPDATE: denial of service and possible code execution via
invalid base64 binary value
- debian/patches/CVE-2016-7130.patch: properly handle string in
ext/wddx/wddx.c, added test to ext/wddx/tests/bug72750.phpt.
- CVE-2016-7130
* SECURITY UPDATE: denial of service and possible code execution via
malformed wddxPacket XML document
- debian/patches/CVE-2016-7131.patch: added checks to ext/wddx/wddx.c,
added tests to ext/wddx/tests/bug72790.phpt,
ext/wddx/tests/bug72799.phpt.
- CVE-2016-7131
- CVE-2016-7132
* SECURITY UPDATE: denial of service and possible code execution via
long pathname
- debian/patches/CVE-2016-7133.patch: fix memory allocator in
Zend/zend_alloc.c.
- CVE-2016-7133
* SECURITY UPDATE: denial of service and possible code execution via
long string and curl_escape call
- debian/patches/CVE-2016-7134.patch: check both curl_escape and
curl_unescape in ext/curl/interface.c.
- CVE-2016-7134
* SECURITY UPDATE: denial of service and possible code execution via
crafted field metadata in MySQL driver
- debian/patches/CVE-2016-7412.patch: validate field length in
ext/mysqlnd/mysqlnd_wireprotocol.c.
- CVE-2016-7412
* SECURITY UPDATE: denial of service and possible code execution via
malformed wddxPacket XML document
- debian/patches/CVE-2016-7413.patch: fixed use-after-free in
ext/wddx/wddx.c, added test to ext/wddx/tests/bug72860.phpt.
- CVE-2016-7413
* SECURITY UPDATE: denial of service and possible code execution via
crafted PHAR archive
- debian/patches/CVE-2016-7414.patch: validate signatures in
ext/phar/util.c, ext/phar/zip.c.
- CVE-2016-7414
* SECURITY UPDATE: denial of service and possible code execution via
MessageFormatter::formatMessage call with a long first argument
- debian/patches/CVE-2016-7416.patch: added locale length check to
ext/intl/msgformat/msgformat_format.c.
- CVE-2016-7416
* SECURITY UPDATE: denial of service or code execution via crafted
serialized data
- debian/patches/CVE-2016-7417.patch: added type check to
ext/spl/spl_array.c, added test to ext/spl/tests/bug73029.phpt, fix
test in ext/spl/tests/bug70068.phpt.
- CVE-2016-7417
* SECURITY UPDATE: denial of service and possible code execution via
malformed wddxPacket XML document
- debian/patches/CVE-2016-7418.patch: fix out-of-bounds read in
ext/wddx/wddx.c, added test to ext/wddx/tests/bug73065.phpt.
- CVE-2016-7418
-- Marc Deslauriers <email address hidden> Mon, 03 Oct 2016 15:48:48 -0400
-
php7.0 (7.0.8-3ubuntu2) yakkety; urgency=medium
* SECURITY UPDATE: proxy request header vulnerability (httpoxy)
- debian/patches/CVE-2016-5385.patch: only use HTTP_PROXY from the
local environment in ext/standard/basic_functions.c, main/SAPI.c,
main/php_variables.c.
- CVE-2016-5385
* SECURITY UPDATE: inadequate error handling in bzread()
- debian/patches/CVE-2016-5399.patch: do not allow reading past error
read in ext/bz2/bz2.c.
- CVE-2016-5399
* SECURITY UPDATE: integer overflow in the virtual_file_ex function
- debian/patches/CVE-2016-6289.patch: properly check path_length in
Zend/zend_virtual_cwd.c.
- CVE-2016-6289
* SECURITY UPDATE: use after free in unserialize() with unexpected
session deserialization
- debian/patches/CVE-2016-6290.patch: destroy var_hash properly in
ext/session/session.c, added test to ext/session/tests/bug72562.phpt.
- CVE-2016-6290
* SECURITY UPDATE: out of bounds read in exif_process_IFD_in_MAKERNOTE
- debian/patches/CVE-2016-6291.patch: add more bounds checks to
ext/exif/exif.c.
- CVE-2016-6291
* SECURITY UPDATE: NULL pointer dereference in exif_process_user_comment
- debian/patches/CVE-2016-6292.patch: properly handle encoding in
ext/exif/exif.c.
- CVE-2016-6292
* SECURITY UPDATE: locale_accept_from_http out-of-bounds access
- debian/patches/CVE-2016-6294.patch: check length in
ext/intl/locale/locale_methods.c, added test to
ext/intl/tests/bug72533.phpt.
- CVE-2016-6294
* SECURITY UPDATE: use after free vulnerability in SNMP with GC and
unserialize()
- debian/patches/CVE-2016-6295.patch: add new handler to
ext/snmp/snmp.c, add test to ext/snmp/tests/bug72479.phpt.
- CVE-2016-6295
* SECURITY UPDATE: heap buffer overflow in simplestring_addn
- debian/patches/CVE-2016-6296.patch: prevent overflows in
ext/xmlrpc/libxmlrpc/simplestring.*.
- CVE-2016-6296
* SECURITY UPDATE: integer overflow in php_stream_zip_opener
- debian/patches/CVE-2016-6297.patch: use size_t in
ext/zip/zip_stream.c.
- CVE-2016-6297
* debian/patches/fix_exif_tests.patch: fix exif test results after
security changes.
-- Marc Deslauriers <email address hidden> Wed, 27 Jul 2016 08:14:20 -0400
-
php7.0 (7.0.8-3ubuntu1) yakkety; urgency=low
* Merge with Debian unstable (LP: #1596735). Remaining changes:
- Drop dh-php from Recommends to Suggests so it can be demoted to
universe (LP: #1590623).
+ dh-php has gained a dependency on xml2 which is in universe.
php7.0 (7.0.8-3) unstable; urgency=medium
[ Ondřej Surý ]
* Improve libapache2-mod-php script to switch MPM only on fresh installs
* libapache2-mod-phpX.Y now recommends apache2 package (as this is what
most people want anyway)
[ Marc Deslauriers ]
* Re-enable test suite
[ Ondřej Surý ]
* Update d/setup-mysql.sh to support MySQL 5.5, 5.6 and 5.7 and
build-depend on libnss-myhostname so mysql_install_db --force option
is not needed
php7.0 (7.0.8-2) unstable; urgency=medium
[ Thomas Häber ]
* fix typo in Tighten depends on pcre3 to workaround symbols brokeness
php7.0 (7.0.8-1) unstable; urgency=medium
* Tighten depends on pcre3 to workaround symbols brokeness
* Imported Upstream version 7.0.8
* Rebase patches on top of 7.0.8 release
* Adjust tidy extension for tidy-html5
php7.0 (7.0.7-5) unstable; urgency=medium
* Add Breaks: gforge-common (<< 6) to php7.0-common (Closes: #827413)
-- Nishanth Aravamudan <email address hidden> Mon, 27 Jun 2016 16:33:17 -0700
-
php7.0 (7.0.7-4ubuntu2) yakkety; urgency=medium
* Actually drop dh-php from Recommends to Suggests by modifying
d/control.in as well (LP: #1590623).
-- Nishanth Aravamudan <email address hidden> Thu, 09 Jun 2016 19:56:16 -0700
-
php7.0 (7.0.7-4ubuntu1) yakkety; urgency=medium
* Drop dh-php from Recommends to Suggests so it can be demoted to
universe (LP: #1590623).
- dh-php has gained a dependency on xml2 which is in universe.
-- Nishanth Aravamudan <email address hidden> Wed, 08 Jun 2016 17:13:12 -0700
-
php7.0 (7.0.7-4) unstable; urgency=medium
* Don't break apache2 configuration if setenvif_module is not enabled
(Closes: #825933)
* Add notice about apache2 notices when apache2 package is installed
-- Ondřej Surý <email address hidden> Fri, 03 Jun 2016 13:22:25 +0200
-
php7.0 (7.0.7-3) unstable; urgency=medium
* The alternative base-files dependency to *systemd* deps is also
required only on linux-any
-- Ondřej Surý <email address hidden> Fri, 27 May 2016 13:21:07 +0200
-
php7.0 (7.0.4-7ubuntu4) yakkety; urgency=medium
* debian/patches/0053-backport-68ebfc87.patch: Fix bug #71624,
PHP_MODE_PROCESS_STDIN (CLI SAPI called with '-R') did not properly
set $argi and $argn. Closes LP: #1572465.
-- Nishanth Aravamudan <email address hidden> Wed, 20 Apr 2016 19:05:43 -0700
-
php7.0 (7.0.4-7ubuntu3) yakkety; urgency=medium
* No-change rebuild for libicu soname change.
-- Matthias Klose <email address hidden> Fri, 22 Apr 2016 22:59:16 +0000
-
php7.0 (7.0.4-7ubuntu2) xenial; urgency=medium
* debian/patches/0052-backport-186844be.patch: Fix bug #71695: Global
variables are resreved before execution. Closes LP: #1569509.
-- Nishanth Aravamudan <email address hidden> Wed, 13 Apr 2016 12:45:21 -0700
