MDKSA-2005:238 - Updated php/php-mbstring packages fix mail injection vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2005:238
http://www.mandriva.com/security/
_______________________________________________________________________
Package : php
Date : December 27, 2005
Affected: 2006.0
_______________________________________________________________________
Problem Description:
A CRLF injection vulnerability in the mb_send_mail function in PHP
before 5.1.0 might allow remote attackers to inject arbitrary
e-mail headers via line feeds (LF) in the "To" address argument, when
using sendmail as the MTA (mail transfer agent).
The updated packages have been patched to address this issue. Once the
new packages have been installed, you will need to restart your Apache
server using "service httpd restart" in order for the new packages to
take effect.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3883
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2006.0:
56df29cd687ea6ebf1cc9a1ae63a57e5
2006.0/RPMS/libphp5_common5-5.0.4-9.2.20060mdk.i586.rpm
a11b5e93d7abf400d2d93960ccca1c5d
2006.0/RPMS/php-cgi-5.0.4-9.2.20060mdk.i586.rpm
fd780d49c9a03ec0f79c1bdc72e731bd
2006.0/RPMS/php-cli-5.0.4-9.2.20060mdk.i586.rpm
ab02893570049594e59ada69226c4c40
2006.0/RPMS/php-devel-5.0.4-9.2.20060mdk.i586.rpm
2034f37afd79db0c9fe9a85638074741
2006.0/RPMS/php-fcgi-5.0.4-9.2.20060mdk.i586.rpm
3c670610b9b775c15b5ff8123053e3d6
2006.0/RPMS/php-mbstring-5.0.4-1.1.20060mdk.i586.rpm
49f649f8e0e6971c9dc57aed47283f33 2006.0/SRPMS/php-5.0.4-9.2.20060mdk.src.rpm
50ff56f7e81807f8b2509b32d0fa779a
2006.0/SRPMS/php-mbstring-5.0.4-1.1.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
97ea04332ebbfed112efeb254dc8ecab
x86_64/2006.0/RPMS/lib64php5_common5-5.0.4-9.2.20060mdk.x86_64.rpm
1ceddbff0b0304d86448c8654bed7693
x86_64/2006.0/RPMS/php-cgi-5.0.4-9.2.20060mdk.x86_64.rpm
1782dbfc99e0d183a3bb46723a65f1e2
x86_64/2006.0/RPMS/php-cli-5.0.4-9.2.20060mdk.x86_64.rpm
df10015113a4324d3cf8660723052df1
x86_64/2006.0/RPMS/php-devel-5.0.4-9.2.20060mdk.x86_64.rpm
72771069aaa978f51f0a037f348a2be1
x86_64/2006.0/RPMS/php-fcgi-5.0.4-9.2.20060mdk.x86_64.rpm
145928c34d497040282e6b05fcb53221
x86_64/2006.0/RPMS/php-mbstring-5.0.4-1.1.20060mdk.x86_64.rpm
49f649f8e0e6971c9dc57aed47283f33
x86_64/2006.0/SRPMS/php-5.0.4-9.2.20060mdk.src.rpm
50ff56f7e81807f8b2509b32d0fa779a
x86_64/2006.0/SRPMS/php-mbstring-5.0.4-1.1.20060mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFDsYT/mqjQ0CJFipgRAvyYAJ45bD4urla+HGZRVUSgcCnFiIxggQCeOJHf
A47hvb6w9oAx+bGup9p2iBU=
=Igz1
-----END PGP SIGNATURE-----