1

I recently came across an extension to a popular CMS that would not install on an Ubuntu 12.04 server, because PHP version 5.3 reached end of live. I was however under the impression that all security upgrades would be backported into Ubuntu 12.04 until its end of live.

I checked this on the changelog of the package: http://changelogs.ubuntu.com/changelogs/pool/main/p/php5/php5_5.3.2-1ubuntu4.28/changelog however I see that updates have ended on 28 Oct 2014, whereas many security updates were made to PHP 5.4 since then that I would have expected to be backdated.

On the other hand it may not be feasible to backport from PHP 5.4.

I'm not looking for a way to install the extension, but on advice if Ubuntu 12.04 with all security updates applied is vulnerable to rcent PHp security issues.

Improve this question
10
  • "software component that would not install on an Ubuntu 12.04 server, because PHP version 5.3 reached end of live" - that's a strange reason. How did the software component know this?
    – muru
    Jan 28, 2015 at 20:51
  • This was an extension to Joomla
    – jdog
    Jan 28, 2015 at 20:52
  • If the extension checks for a minimum version of PHP, then there's nothing much that can be done from Ubuntu's side.
    – muru
    Jan 28, 2015 at 20:54
  • I'm not looking for a way to install the extension, but on advice if Ubuntu 12.04 with all security updates applied is vulnerable to rcent PHp security issues. Its also likely that I can convince the extension developer to make his version detection more sophisticated - if and only if PHP 5.3 on Ubuntu 12 is actually secure
    – jdog
    Jan 28, 2015 at 20:55
  • 1
    Your comments were very useful. Am currently testing bugs.php.net/bug.php?id=68594 on both Ubuntu 12 and 14 server and will report bug in Launchpad. Results will form the answers.
    – jdog
    Jan 28, 2015 at 21:14

1 Answer 1

Reset to default
2

The Ubuntu security team will backport security fixes, if the version in a supported Ubuntu release is affected. You can keep an eye on this using the Ubuntu CVE Tracker. For example, a recent CVE (CVE-2014-8142) had Ubuntu 10.04's version of PHP marked as "not-affected". For issues which don't have an associated CVE, you could file a bug on the appropriate Launchpad page, and let the devs decide.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.