Ubuntu Security Notice 989-1 – Auke van Slooten discovered that PHP incorrectly handled certain xmlrpc requests. It was discovered that the pseudorandom number generator in PHP did not provide the expected entropy. It was discovered that PHP did not properly handle directory pathnames that lacked a trailing slash character. Grzegorz Stachowiak discovered that the PHP session extension did not properly handle semicolon characters. Stefan Esser discovered that PHP incorrectly decoded remote HTTP chunked encoding streams. Various other issues were also addressed.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/94071/USN-989-1.txt
Source: https://packetstormsecurity.com/files/94071/Ubuntu-Security-Notice-989-1.html