php5 - security update

• CVE-2016-5093
  Absence of null character causes unexpected zend_string length and
  leaks heap memory. The test script uses locale_get_primary_language
  to reach get_icu_value_internal but there are some other functions
  that also trigger this issue:

locale_canonicalize, locale_filter_matches,

locale_lookup, locale_parse

• CVE-2016-5094
  don’t create strings with lengths outside int range
• CVE-2016-5095
  similar to CVE-2016-5094
  don’t create strings with lengths outside int range
• CVE-2016-5096
  int/size_t confusion in fread
• CVE-TEMP-bug-70661

bug70661: Use After Free Vulnerability in WDDX Packet Deserialization

• CVE-TEMP-bug-70728

bug70728: Type Confusion Vulnerability in PHP_to_XMLRPC_worker()

• CVE-TEMP-bug-70741

bug70741: Session WDDX Packet Deserialization Type Confusion
Vulnerability

• CVE-TEMP-bug-70480-raw

bug70480: php_url_parse_ex() buffer overflow read

For Debian 7 Wheezy, these problems have been fixed in version
5.4.45-0+deb7u4.

We recommend that you upgrade your php5 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: <https://wiki.debian.org/LTS&gt;