Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4359 > unrolled thread

Re: [SECURITY] [DSA 3358-1] php5 security update

Back to article view | Back to linux.debian.security

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [SECURITY] [DSA 3358-1] php5 security update Wolfgang Karall-Ahlborn <lists+debian-security@karall-edv.at> - 2015-09-14 17:30 +0200
    Re: [SECURITY] [DSA 3358-1] php5 security update Moritz Mühlenhoff <jmm@inutil.org> - 2015-09-15 20:00 +0200
      Re: [SECURITY] [DSA 3358-1] php5 security update Wolfgang Karall <lists+debian-security@karall-edv.at> - 2015-09-15 20:30 +0200
        Re: [SECURITY] [DSA 3358-1] php5 security update Moritz Mühlenhoff <jmm@inutil.org> - 2015-09-15 23:10 +0200

#4359 — Re: [SECURITY] [DSA 3358-1] php5 security update

[Multipart message — attachments visible in raw view] — view raw

Hello,

since today marks the end of the security support for PHP 5.4, does
anyone know how the security support for wheezy will continue? Will
there be an in-release upgrade to 5.5.x?

Cheers
Wolfgang

On 15-09-13 14:58:00, Salvatore Bonaccorso wrote:
> -------------------------------------------------------------------------
> Debian Security Advisory DSA-3358-1                   security@debian.org
> https://www.debian.org/security/                     Salvatore Bonaccorso
> September 13, 2015                    https://www.debian.org/security/faq
> -------------------------------------------------------------------------
> 
> Package        : php5
> CVE ID         : CVE-2015-6834 CVE-2015-6835 CVE-2015-6836 CVE-2015-6837 
>                  CVE-2015-6838
> 
> Several vulnerabilities were found in PHP, a general-purpose scripting
> language commonly used for web application development.
> 
> The vulnerabilities are addressed by upgrading PHP to new upstream
> versions (5.4.45 and 5.6.13), which include additional bug fixes. Please
> refer to the upstream changelog for more information:
> 
>  https://php.net/ChangeLog-5.php#5.4.45
>  https://php.net/ChangeLog-5.php#5.6.13
> 
> For the oldstable distribution (wheezy), these problems have been fixed
> in version 5.4.45-0+deb7u1.
> 
> For the stable distribution (jessie), these problems have been fixed in
> version 5.6.13+dfsg-0+deb8u1.
> 
> We recommend that you upgrade your php5 packages.
> 
> Further information about Debian Security Advisories, how to apply
> these updates to your system and frequently asked questions can be
> found at: https://www.debian.org/security/
> 
> Mailing list: debian-security-announce@lists.debian.org
> 

[toc] | [next] | [standalone]

#4361

Wolfgang Karall-Ahlborn <lists+debian-security@karall-edv.at> schrieb:
>
> --bGR76rFJjkSxVeRa
> Content-Type: text/plain; charset=us-ascii
> Content-Disposition: inline
> Content-Transfer-Encoding: quoted-printable
>
> Hello,
>
> since today marks the end of the security support for PHP 5.4, does
> anyone know how the security support for wheezy will continue? Will
> there be an in-release upgrade to 5.5.x?

The upstream security support time frame isn't identical to the support
time frame in Debian, e.g. PHP 5.3 from squeeze also continues to
be security-supported.

Cheers,
        Moritz

[toc] | [prev] | [next] | [standalone]

#4362

[Multipart message — attachments visible in raw view] — view raw

Hello Moritz,

On 15-09-15 13:58:52, Moritz Mühlenhoff wrote:
> The upstream security support time frame isn't identical to the support
> time frame in Debian, e.g. PHP 5.3 from squeeze also continues to
> be security-supported.

I was under the impression that PHP security support at some point
switched to following the upstream versions, but I'm happy to see
backported security fixes for Debian 5.4 in wheezy.

Cheers
Wolfgang

[toc] | [prev] | [next] | [standalone]

#4363

Wolfgang Karall <lists+debian-security@karall-edv.at> schrieb:
>
> --rQ2U398070+RC21q
> Content-Type: text/plain; charset=iso-8859-1
> Content-Disposition: inline
> Content-Transfer-Encoding: quoted-printable
>
> Hello Moritz,
>
> On 15-09-15 13:58:52, Moritz M=FChlenhoff wrote:
>> The upstream security support time frame isn't identical to the support
>> time frame in Debian, e.g. PHP 5.3 from squeeze also continues to
>> be security-supported.
>
> I was under the impression that PHP security support at some point
> switched to following the upstream versions, but I'm happy to see
> backported security fixes for Debian 5.4 in wheezy.

Correct, as long as PHP ships their point releases, we're now
releasing these through security.debian.org, but once that ends
we can still backport fixes on our own.

So, wheezy will stick with 5.4.

Cheers,
        Moritz

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web