The following updates has been released for Debian GNU/Linux 8 LTS:

DLA 1739-1: rails security update
DLA 1741-1: php5 security update

DLA 1739-1: rails security update

Package : rails
Version : 2:4.1.8-1+deb8u5
CVE ID : CVE-2019-5418 CVE-2019-5419
Debian Bug : 924520

John Hawthorn of Github discovered a file content disclosure
vulnerability in Rails, a ruby based web application framework.
Specially crafted accept headers in combination with calls to `render
file:` can cause arbitrary files on the target server to be rendered,
disclosing the file contents.

This vulnerability could also be exploited for a denial-of-service
attack.

For Debian 8 "Jessie", these problems have been fixed in version
2:4.1.8-1+deb8u5.

We recommend that you upgrade your rails packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

DLA 1741-1: php5 security update

Package : php5
Version : 5.6.40+dfsg-0+deb8u2
CVE ID : CVE-2019-9022 CVE-2019-9637 CVE-2019-9638 CVE-2019-9639
CVE-2019-9640 CVE-2019-9641


Several vulnerabilities have been found in php5, a server-side,
HTML-embedded scripting language.


CVE-2019-9637
rename() across the device may allow unwanted access during
processing.

CVE-2019-9638, CVE-2019-9639
Uninitialized read in exif_process_IFD_in_MAKERNOTE.

CVE-2019-9640
Invalid Read on exif_process_SOFn.

CVE-2019-9641
Uninitialized read in exif_process_IFD_in_TIFF.

CVE-2019-9022
An issue during parsing of DNS responses allows a hostile DNS server
to misuse memcpy, which leads to a read operation past an allocated
buffer.


For Debian 8 "Jessie", these problems have been fixed in version
5.6.40+dfsg-0+deb8u2.

We recommend that you upgrade your php5 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS