Univention Corporate Server 4.2 erratum 473 (security)

This update addresses the following issues:
* reflected XSS in .phar 404 page (CVE-2018-5712)
* Stack-based buffer under-read in
  ext/standard/http_fopen_wrapper.c:php_stream_url_wrap_http_ex function when
  parsing HTTP response allows denial of service (CVE-2018-7584)
* Dumpable FPM child processes allow bypassing opcache access controls
  (CVE-2018-10545)
* Infinite loop in ext/iconv/iconv.c when using stream filter with
  convert.incov on invalid sequence leads to denial-of-service
  (CVE-2018-10546)
* Reflected XSS vulnerability on PHAR 403 and 404 error pages
  (CVE-2018-10547)
* Null pointer dereference due to mishandling of ldap_get_dn return value
  allows denial-of-service by malicious LDAP server or man-in-the-middle
  attacker (CVE-2018-10548)
* Out-of-bounds read in ext/exif/exif.c:exif_read_data() when reading crafted
  JPEG data (CVE-2018-10549)