Any fix for PHP Remote Code Execution vulnerability?

April 9, 2018 715 views
PHP Ubuntu
cloudnine
By:
cloudnine

I came across the recent exposure of a major remote code execution vulnerability in PHP:
https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-php-could-allow-for-arbitrary-code-execution_2018-023/

I am running a server with PHP 5.5.9 (Ubuntu 14.04) and it's not clear to me how to upgrade it to something higher than 5.6.34 to keep myself protected.

Can anyone with droplets on D.O who has patched their server (s) recently, offer any suggestions? As far as I have seen, running apt-get upgrade doesn't seem to offer the version of PHP that's more secure (can't upgrade to PHP 7.0 on a production server.

Thanks in advance.

Log In to Comment
1 Answer
ryanpq MOD April 9, 2018
Accepted Answer

When looking to patch a vulnerability using official packages it should be noted that distributions like Ubuntu backport fixes to previous versions rather than pushing updates on their LTS releases. For this reason the version number alone cannot be used to determine if your PHP package is vulnerable. Ubuntu 14.04 has not reached EOL and should make a patch available for it's current PHP version which backports this fix.

Reply
  • cloudnine April 10, 2018

    Thanks, that's helpful. One doubt, though - until the patch becomes available, wouldn't the server be left unprotected?

    Also, is there somewhere I can track when Ubuntu 14.04 will make this patch available?

Have another answer? Share your knowledge.

Related Questions