Red Hat Security Advisory: php security and bug fix update

CVE-2014-8142 — php: use after free vulnerability in unserialize() CVE-2014-9652 — file: out of bounds read in mconvert() CVE-2014-9705 — php: heap buffer overflow in enchant_broker_request_dict() CVE-2014-9709 — gd: buffer read overflow in gd_gif_in.c CVE-2015-0231 — php: use after free vulnerability in unserialize() (incomplete fix of CVE-2014-8142) CVE-2015-0232 — php: Free called on unitialized pointer in exif.c CVE-2015-0273 — php: use after free vulnerability in unserialize() with DateTimeZone CVE-2015-2301 — php: use after free in phar_object.c CVE-2015-2348 — php: move_uploaded_file() NUL byte injection in file name CVE-2015-2783 — php: buffer over-read in Phar metadata parsing CVE-2015-2787 — php: use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re CVE-2015-3307 — php: invalid pointer free() in phar_tar_process_metadata() CVE-2015-3329 — php: buffer overflow in phar_set_inode() CVE-2015-3330 — php: pipelined request executed in deinitialized interpreter under httpd 2.4 CVE-2015-3411 — php: missing null byte checks for paths in various PHP extensions CVE-2015-3412 — php: missing null byte checks for paths in various PHP extensions CVE-2015-4021 — php: memory corruption in phar_parse_tarfile caused by empty entry file name CVE-2015-4022 — php: integer overflow leading to heap overflow when reading FTP file listing CVE-2015-4024 — php: multipart/form-data request parsing CPU usage DoS CVE-2015-4025 — php: regressions in 5.4+ CVE-2015-4026 — php: pcntl_exec() accepts paths with NUL character CVE-2015-4147 — php: SoapClient's __call() type confusion through unserialize() CVE-2015-4148 — php: SoapClient's do_soap_call() type confusion after unserialize() CVE-2015-4598 — php: missing null byte checks for paths in DOM and GD extensions CVE-2015-4599 — php: type confusion issue in unserialize() with various SOAP methods CVE-2015-4600 — php: type confusion issue in unserialize() with various SOAP methods CVE-2015-4601 — php: type confusion issue in unserialize() with various SOAP methods CVE-2015-4602 — php: Incomplete Class unserialization type confusion CVE-2015-4603 — php: exception:: getTraceAsString type confusion issue after unserialize CVE-2015-4604 — php: denial of service when processing a crafted file with Fileinfo CVE-2015-4605 — php: denial of service when processing a crafted file with Fileinfo CVE-2015-4643 — php: integer overflow in ftp_genlist() resulting in heap overflow (improved fix for CVE-2015-4022)