libapache2-mod-php7.2: University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rs...
CVE-2018-19518 is fixed in 40 products on 1 platform, first by libc-client2007e 8:2007f~dfsg-5ubuntu0.18.04.2, released November 25, 2018. It is not reported as exploited. Patch Radar priority: Routine.
University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| libapache2-mod-php7.2 · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | libapache2-mod-php7.2 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| libc-client2007e · Ubuntu 18.04.6 LTS (bionic) | 8:2007f~dfsg-5ubuntu0.18.04.2 | libc-client2007e 8:2007f~dfsg-5ubuntu0.18.04.2 | Nov 25, 2018 |
| libphp7.2-embed · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | libphp7.2-embed 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| mlock · Ubuntu 18.04.6 LTS (bionic) | 8:2007f~dfsg-5ubuntu0.18.04.2 | mlock 8:2007f~dfsg-5ubuntu0.18.04.2 | Nov 25, 2018 |
| php7.2 · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-bcmath · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-bcmath 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-bz2 · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-bz2 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-cgi · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-cgi 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-cli · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-cli 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-common · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-common 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-curl · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-curl 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-dba · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-dba 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-enchant · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-enchant 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-fpm · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-fpm 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-gd · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-gd 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-gmp · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-gmp 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-imap · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-imap 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-interbase · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-interbase 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-intl · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-intl 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-json · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-json 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-ldap · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-ldap 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-mbstring · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-mbstring 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-mysql · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-mysql 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-odbc · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-odbc 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-opcache · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-opcache 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-pgsql · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-pgsql 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-phpdbg · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-phpdbg 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-pspell · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-pspell 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-readline · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-readline 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-recode · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-recode 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-snmp · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-snmp 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-soap · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-soap 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-sqlite3 · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-sqlite3 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-sybase · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-sybase 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-tidy · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-tidy 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-xml · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-xml 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-xmlrpc · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-xmlrpc 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-xsl · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-xsl 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| php7.2-zip · Ubuntu 18.04.6 LTS (bionic) | 7.2.15-0ubuntu0.18.04.1 | php7.2-zip 7.2.15-0ubuntu0.18.04.1 | Feb 21, 2019 |
| uw-mailutils · Ubuntu 18.04.6 LTS (bionic) | 8:2007f~dfsg-5ubuntu0.18.04.2 | uw-mailutils 8:2007f~dfsg-5ubuntu0.18.04.2 | Nov 25, 2018 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.