[MRE] Please update to latest upstream release 7.0.28 / 7.1.15 / 7.2.3

[Simon Déziel]

Upstream has put out many more microversions addressing security issues and other bug fixes. Here is a list of the CVEs addressed by those:

PHP 7.0.26 (23 Nov 2017):

* No CVE addressed

PHP 7.0.27 / 7.1.13 (04 Jan 2018):

* https://bugs.php.net/bug.php?id=64938 / https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8866
* https://bugs.php.net/bug.php?id=75571 / http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5711
* https://bugs.php.net/bug.php?id=74782 / http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5712

PHP 7.1.12 (23 Nov 2017):

* No CVE addressed

PHP 7.1.14 (01 Feb 2018):

* No CVE addressed

PHP 7.0.28 / 7.1.15 / 7.2.3 (01 Mar 2018):

* https://bugs.php.net/bug.php?id=75981 / https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7584

Changelog: https://secure.php.net/ChangeLog-7.php

[Nish Aravamudan (nacc)]

@Marc: php7.0/7.1 is ready to sponsor into xenial-security (and -updates). You should only need to do some changelog mangling to match the security team's format, and a `uscan` to grab the orig tarball from upstream.

[Launchpad Janitor (janitor)]

This bug was fixed in the package php7.2 - 7.2.3-1ubuntu1

---------------
php7.2 (7.2.3-1ubuntu1) bionic; urgency=medium

  * Merge with Debian unstable (LP: #1744148). Remaining changes:
    - Drop dh-php from Recommends to Suggests so it can be demoted to
      universe as it depends on xml2/universe.

php7.2 (7.2.3-1) unstable; urgency=medium

  * New upstream version 7.2.3
  * Rebase patches on top of new upstream release.

php7.2 (7.2.2-3) unstable; urgency=medium

  * Add explicit libpcre3 >= 2:8.35 dependency as dh_genshlibs is failing
    to add versioned dependency for some reason.

php7.2 (7.2.2-2) unstable; urgency=medium

  * Remove explicit libpcre3 dependency and let dh_genshlibs do its magic

 -- Nishanth Aravamudan <email address hidden> Wed, 14 Mar 2018 15:03:58 -0700

[Launchpad Janitor (janitor)]

This bug was fixed in the package php7.1 - 7.1.15-0ubuntu0.17.10.1

---------------
php7.1 (7.1.15-0ubuntu0.17.10.1) artful-security; urgency=medium

  * New upstream release (7.1.15)
    - LP: #1744148
    - Refresh patches.
    - CVE-2018-5712
    - CVE-2018-7584

 -- Nishanth Aravamudan <email address hidden> Wed, 14 Mar 2018 15:30:42 -0700

[Launchpad Janitor (janitor)]

This bug was fixed in the package php7.0 - 7.0.28-0ubuntu0.16.04.1

---------------
php7.0 (7.0.28-0ubuntu0.16.04.1) xenial-security; urgency=medium

  * New upstream release (7.0.28)
    - LP: #1744148
    - CVE-2018-5712
    - CVE-2018-7584

 -- Nishanth Aravamudan <email address hidden> Wed, 14 Mar 2018 15:22:51 -0700