(Jun 26) Updated kernel packages that fix three security issues are now available for Red Hat Enterprise Linux 6.2 Extended Update Support. The Red Hat Security Response Team has rated this update as having [More…]
Comment
We’ve always strived to keep Plesk visually modern and pleasant for users, so we have created a new additional skin for Plesk 12. We would love to hear your opinion on this skin, as we’re evaluating it as a possible replacement for current default Plesk skin.
Please go to this page and participate in our survey – http://surveymonkey.com/s/Plesk12-new-skin
Thank you for cooperation!
EasyApache 3.24.22 Released
Jul01
on July 1, 2014
at 12:15 am
Posted In: 3.24, Community, cPanel, easyapache, Hosting, News, ProdDevSec, release, Software Updates
SUMMARY
cPanel, Inc. has released EasyApache 3.24.22 with PHP 5.4.30 and 5.5.14. This release addresses multiple PHP vulnerabilities in the PHP core code and the Fileinfo, Network, and SPL modules. We encourage all PHP users to upgrade to PHP 5.4.30 and PHP 5.5.14.
AFFECTED VERSIONS
All versions of PHP 5.4 before 5.4.30.
All versions of PHP 5.5 before 5.5.14.
SECURITY RATING
The National Vulnerability Database (NIST) has given the following severity ratings to these CVEs:
CVE-2014-3981 – LOW
PHP 5.4.30 and PHP 5.5.14
Fixed bug in the PHP core code related to CVE-2014-3981.
CVE-2014-0207 – MEDIUM
PHP 5.4.30 and PHP 5.5.14
Fixed bug in the Fileinfo module related to CVE-2014-0207.
CVE-2014-3478 – MEDIUM
PHP 5.4.30 and PHP 5.5.14
Fixed bug in the Fileinfo module related to CVE-2014-3478.
CVE-2014-3479 – MEDIUM
PHP 5.4.30 and PHP 5.5.14
Fixed bug in the Fileinfo module related to CVE-2014-3479.
CVE-2014-3480 – MEDIUM
PHP 5.4.30 and PHP 5.5.14
Fixed bug in the Fileinfo module related to CVE-2014-3480.
CVE-2014-3487 – MEDIUM
PHP 5.4.30 and PHP 5.5.14
Fixed bug in the Fileinfo module related to CVE-2014-3487.
CVE-2014-4049 – MEDIUM
PHP 5.4.30 and PHP 5.5.14
Fixed bug in the Network module related to CVE-2014-4049.
CVE-2014-3515 – MEDIUM
PHP 5.4.30 and PHP 5.5.14
Fixed bug in the SPL module related to CVE-2014-3515.
SOLUTION
cPanel, Inc. has released EasyApache 3.24.22 with an updated version of PHP 5.4 and PHP 5.5 to correct this issue. Unless you have disabled EasyApache updates, EasyApache updates automatically. Run EasyApache to rebuild your profile with the latest version of PHP.
REFERENCES
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3981
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0207
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3478
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3479
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3480
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3487
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-4049
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3515
http://www.php.net/ChangeLog-5.php#5.4.30
http://www.php.net/ChangeLog-5.php#5.5.14
For the PGP-signed message, see PHP 5-4-30 and 5-5-14 CVE signed.
(Jun 23) LibreOffice would unconditionally execute certain VBA macros.
(Jun 25) An improvement was made for PHP FPM environments.