PHP CVEs

Description

ext/mysqlnd/mysqlnd.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 uses a client SSL option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.

Affected products and versions

• PHP — Up to and including 5.4.42
• PHP versions 5.5.0, 5.5.0alpha1, 5.5.0alpha2, 5.5.0alpha3, 5.5.0alpha4, 5.5.0alpha5, 5.5.0alpha6, 5.5.0beta1, 5.5.0beta2, 5.5.0beta3, 5.5.0beta4, 5.5.0rc1, 5.5.0rc2, 5.5.1, 5.5.2, 5.5.3, 5.5.4, 5.5.5, 5.5.6, 5.5.7, 5.5.8, 5.5.9, 5.5.10, 5.5.11, 5.5.12, 5.5.13, 5.5.14, 5.5.15, 5.5.16, 5.5.17, 5.5.18, 5.5.19, 5.5.20, 5.5.21, 5.5.22, 5.5.23, 5.5.24, 5.5.25, 5.5.26, 5.6.0alpha1, 5.6.0alpha2, 5.6.0alpha3, 5.6.0alpha4, 5.6.0alpha5, 5.6.0beta1, 5.6.0beta2, 5.6.0beta3, 5.6.0beta4, 5.6.1, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.6.10

References

• git.php.net http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=97aa752fee61fccdec361279adbfb17a3c60f3f4
• lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00052.html
• lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00056.html
• lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00057.html
• lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00058.html
• php.net http://php.net/ChangeLog-5.php
• www.ubuntu.com http://www.ubuntu.com/usn/USN-2952-1
• www.ubuntu.com http://www.ubuntu.com/usn/USN-2952-2
• bugs.php.net https://bugs.php.net/bug.php?id=69669
• nvd.nist.gov Official NVD record