php-5.4.16-42.el7

PHP is an HTML-embedded scripting language. PHP attempts to make it
easy for developers to write dynamically generated web pages. PHP also
offers built-in database integration for several commercial and
non-commercial database management systems, so writing a
database-enabled webpage with PHP is fairly simple. The most common
use of PHP coding is probably as a replacement for CGI scripts.

The php package contains the module (often referred to as mod_php)
which adds support for the PHP language to Apache HTTP Server.

Security issues fixed with this release:

CVE-2016-5399
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be
provided.
CVE-2016-5766
Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD
Graphics Library (aka libgd) before 2.2.3, as used in PHP before
5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote
attackers to cause a denial of service (heap-based buffer overflow and
application crash) or possibly have unspecified other impact via
crafted chunk dimensions in an image.
CVE-2016-5767
Integer overflow in the gdImageCreate function in gd.c in the GD
Graphics Library (aka libgd) before 2.0.34RC1, as used in PHP before
5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote
attackers to cause a denial of service (heap-based buffer overflow and
application crash) or possibly have unspecified other impact via a
crafted image dimensions.
CVE-2016-5768
Double free vulnerability in the _php_mb_regex_ereg_replace_exec
function in php_mbregex.c in the mbstring extension in PHP before
5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote
attackers to execute arbitrary code or cause a denial of service
(application crash) by leveraging a callback exception.

Additional Changes: