mvdgraaf's picture

hello I'm a newbie and I would like to know how to update Php on TKL wp 13.0.

It's now running 5.4.4-14+deb7u8 and has some vulnerabilitie risks.

Thanks a lot.


Jeremy Davis's picture

If you use PHP v5.4.4 on Windows or Mac then you are probably right, there probably are security bugs...

But in Debian (and many other Linux distros) instead of updating the version of software (which often creates incompatibility issues with software and/or system instability) the specific version stays frozen and security fixes are backported and applied. TurnKey Linux is configured to automatically download and install these security fixes as they are released.

If you look at the changlog for the PHP5 package in Debian 7 (Debian 7 aka Wheezy is the basis of TurnKey v13.x) you will see that when Debian 7 went stable it had 5.4.4-14+deb7u1 and it now has 5.4.4-14+deb7u8 (in otherwords the current version has been updated 8 times since the version was frozen at 5.4.4 - 7 times since Debian 7 has been 'stable').

Once security bugs are noted, they are usually fixed very quickly. There have been cases where the bugs where actually found by Debian devs and fixed in Debian before they were made public. Obviously that isn't always the case but the Debian security team take their job very seriously!

Having said that, if you really want to update it is possible, but it is not recommended. It will most likly make your server less secure and higer maintenence...

mvdgraaf's picture

Hello Jeremy


thank you for your explenation. As I already wrote I'm a newbie on this. It's good to have people like you giving advice, I really appreciate what you are doing. I will leave the TKL as it is and trust that the PHP security aspect is fine.

I did a free Web Site Security Audit from Beyond Security and so I found out about the vulnerabilities. 

Here's the report:

Vulnerability Summary
PHP Running Version Prior to 5.4.17
PHP Running Version Prior to 5.4.16
PHP Running Version Prior to 5.4.12
PHP _php_stream_scandir Overflow
PHP Running Version Prior to 5.4.18
PHP Running Version Prior to 5.4.13
PHP expose_php Information Disclosure

 Many thanks.



Add new comment