EasyApache 20 September 2016 Maintenance Release

September 20, 2016

SUMMARY
cPanel, Inc. has released updated RPMs for EasyApache 4 on September 20, 2016, with PHP versions 5.6.26 and 7.0.11. This release addresses vulnerabilities related to CVE-2016-7411, CVE-2016-7412, CVE-2016-7413, CVE-2016-7414, CVE-2016-7416, CVE-2016-7417, and CVE-2016-7418. We strongly encourage all PHP 5.6 users to upgrade to version 5.6.26 and all PHP 7.0 users to upgrade to version 7.0.11.

AFFECTED VERSIONS
All versions of PHP 5.6 through version 5.6.25
All versions of PHP 5.6 through version 7.0.10

SECURITY RATING
The National Vulnerability Database (NIST) has given the following severity ratings to these CVEs:

CVE-2016-7416 – HIGH

PHP 5.6.26
Fixed bug in Intl extension related to CVE-2016-7416

PHP 7.0.11
Fixed bug in Intl extension related to CVE-2016-7416

CVE-2016-7412 – MEDIUM

PHP 5.6.26
Fixed bug in Mysqlnd module related to CVE-2016-7412

PHP 7.0.11
Fixed bug in Mysqlnd module related to CVE-2016-7412

CVE-2016-7414 – MEDIUM

PHP 5.6.26
Fixed bug in Phar module related to CVE-2016-7414

PHP 7.0.11
Fixed bug in Phar module related to CVE-2016-7414

CVE-2016-7417 – MEDIUM

PHP 5.6.26
Fixed bug in SPL library related to CVE-2016-7417

PHP 7.0.11
Fixed bug in SPL library related to CVE-2016-7417

CVE-2016-7411 – MEDIUM

PHP 5.6.26
Fixed bug related to CVE-2016-7411

CVE-2016-7413 – MEDIUM

PHP 5.6.26
Fixed bug in WDDX extension related to CVE-2016-7413

PHP 7.0.11
Fixed bug in WDDX extension related to CVE-2016-7413

CVE-2016-7418 – MEDIUM

PHP 5.6.26
Fixed bug in WDDX extension related to CVE-2016-7418

PHP 7.0.11
Fixed bug in WDDX extension related to CVE-2016-7418

For the PGP-signed message, please see EA4 2016-9-20 CVE

SOLUTION
cPanel, Inc. has released updated RPMs for EasyApache 4 on September 20, 2016, with updated versions of PHP 5.6.26 and 7.0.11. Unless you have enabled automatic RPM updates in your cron, update your system with either yum update or WHM’s Run System Update interface.

REFERENCES
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-7416
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-7412
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-7414
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-7417
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-7411
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-7413
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-7418
http://php.net/ChangeLog-5.php
http://www.php.net/ChangeLog-7.php

SUMMARY
cPanel, Inc. has released EasyApache 3.34.5 with PHP version 5.6.26. This release addresses vulnerabilities related to CVE-2016-7411, CVE-2016-7412, CVE-2016-7413, CVE-2016-7414, CVE-2016-7416, CVE-2016-7417, and CVE-2016-7418. We strongly encourage all PHP 5.6 users to upgrade to version 5.6.26.

AFFECTED VERSIONS
All versions of PHP 5.6 through version 5.6.25