Related

Product App Platform: Run PHP apps without managing servers Product
[:error] [pid 1476] [client 93.174.93.222:57613] script '/var/www/html/xmlrpc.php' not found or unable to stat Question Question
ssh2_auth_pubkey_file : Can't Get To Work Question Question

Question

Any fix for PHP Remote Code Execution vulnerability?

Posted April 9, 2018 3.4k views
UbuntuPHP

I came across the recent exposure of a major remote code execution vulnerability in PHP:
https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-php-could-allow-for-arbitrary-code-execution_2018-023/

I am running a server with PHP 5.5.9 (Ubuntu 14.04) and it’s not clear to me how to upgrade it to something higher than 5.6.34 to keep myself protected.

Can anyone with droplets on D.O who has patched their server (s) recently, offer any suggestions? As far as I have seen, running apt-get upgrade doesn’t seem to offer the version of PHP that’s more secure (can’t upgrade to PHP 7.0 on a production server.

Thanks in advance.

Add a comment
cloudnine
By:
cloudnine

Related

Product App Platform: Run PHP apps without managing servers Product
[:error] [pid 1476] [client 93.174.93.222:57613] script '/var/www/html/xmlrpc.php' not found or unable to stat Question Question
ssh2_auth_pubkey_file : Can't Get To Work Question Question

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

×
1 answer
ryanpq April 9, 2018

When looking to patch a vulnerability using official packages it should be noted that distributions like Ubuntu backport fixes to previous versions rather than pushing updates on their LTS releases. For this reason the version number alone cannot be used to determine if your PHP package is vulnerable. Ubuntu 14.04 has not reached EOL and should make a patch available for it’s current PHP version which backports this fix.

Reply Report
  • cloudnine April 10, 2018

    Thanks, that’s helpful. One doubt, though - until the patch becomes available, wouldn’t the server be left unprotected?

    Also, is there somewhere I can track when Ubuntu 14.04 will make this patch available?

    Reply Report
Submit an Answer

Related

Looking for something else?

Ask a new question Search for more help