[ MDVSA-2009:023 ] php
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2009:023
http://www.mandriva.com/security/
_______________________________________________________________________
Package : php
Date : January 21, 2009
Affected: Corporate 4.0
_______________________________________________________________________
Problem Description:
A vulnerability in PHP allowed context-dependent attackers to cause
a denial of service (crash) via a certain long string in the glob()
or fnmatch() functions (CVE-2007-4782).
A vulnerability in the cURL library in PHP allowed context-dependent
attackers to bypass safe_mode and open_basedir restrictions and read
arbitrary files using a special URL request (CVE-2007-4850).
An integer overflow in PHP allowed context-dependent attackers to
cause a denial of serivce via a special printf() format parameter
(CVE-2008-1384).
A stack-based buffer overflow in the FastCGI SAPI in PHP has unknown
impact and attack vectors (CVE-2008-2050).
Tavis Ormandy of the Google Security Team discovered a heap-based
buffer overflow when compiling certain regular expression patterns.
This could be used by a malicious attacker by sending a specially
crafted regular expression to an application using the PCRE library,
resulting in the possible execution of arbitrary code or a denial of
service (CVE-2008-2371). PHP in Corporate Server 4.0 is affected by
this issue.
A buffer overflow in the imageloadfont() function in PHP allowed
context-dependent attackers to cause a denial of service (crash)
and potentially execute arbitrary code via a crafted font file
(CVE-2008-3658).
A buffer overflow in the memnstr() function allowed context-dependent
attackers to cause a denial of service (crash) and potentially execute
arbitrary code via the delimiter argument to the explode() function
(CVE-2008-3659).
PHP, when used as a FastCGI module, allowed remote attackers to cause
a denial of service (crash) via a request with multiple dots preceding
the extension (CVE-2008-3660).
An array index error in the imageRotate() function in PHP allowed
context-dependent attackers to read the contents of arbitrary memory
locations via a crafted value of the third argument to the function
for an indexed image (CVE-2008-5498).
The updated packages have been patched to correct these issues.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4782
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4850
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1384
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2050
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2371
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3658
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3659
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3660
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5498
_______________________________________________________________________
Updated Packages:
Corporate 4.0:
d55d5489013a1f9e95262571a5ef2979
corporate/4.0/i586/libphp5_common5-5.1.6-1.10.20060mlcs4.i586.rpm
8701a5ab0e71009171216ccda307e547
corporate/4.0/i586/php-cgi-5.1.6-1.10.20060mlcs4.i586.rpm
d3e8b97d03ccd01127a1aeb9e17d3d7e
corporate/4.0/i586/php-cli-5.1.6-1.10.20060mlcs4.i586.rpm
6e0aa2965637f3dbc25cff1d5064bb8c
corporate/4.0/i586/php-curl-5.1.6-1.1.20060mlcs4.i586.rpm
0458b8aa8daa0e39cd329761eae9d654
corporate/4.0/i586/php-devel-5.1.6-1.10.20060mlcs4.i586.rpm
89487acc8fa77864d25e5aebc40bc9b4
corporate/4.0/i586/php-fcgi-5.1.6-1.10.20060mlcs4.i586.rpm
bf404efb4e9567f431256d36833fc8d6
corporate/4.0/i586/php-pcre-5.1.6-1.1.20060mlcs4.i586.rpm
c62fb74e0d8744077e4c8ff6f50df98b
corporate/4.0/SRPMS/php-5.1.6-1.10.20060mlcs4.src.rpm
e46cf717872ddfbf6a13f6d45d225533
corporate/4.0/SRPMS/php-curl-5.1.6-1.1.20060mlcs4.src.rpm
b188d26d6a781b5066d515ed5ae36ace
corporate/4.0/SRPMS/php-pcre-5.1.6-1.1.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
70d99222e5692b2fd88fcb05f8f5e620
corporate/4.0/x86_64/lib64php5_common5-5.1.6-1.10.20060mlcs4.x86_64.rpm
62448b1b344cdc098b6620e0e773ef17
corporate/4.0/x86_64/php-cgi-5.1.6-1.10.20060mlcs4.x86_64.rpm
dc0df43cfe80f4b5017924152d43a91f
corporate/4.0/x86_64/php-cli-5.1.6-1.10.20060mlcs4.x86_64.rpm
9ac37cd014c4012a964e65cbe9d1b01a
corporate/4.0/x86_64/php-curl-5.1.6-1.1.20060mlcs4.x86_64.rpm
6ac51f6b50172ee6d5eb36ce8b8cba77
corporate/4.0/x86_64/php-devel-5.1.6-1.10.20060mlcs4.x86_64.rpm
ab26bfe0c8370bd2bf37205cbc1df63b
corporate/4.0/x86_64/php-fcgi-5.1.6-1.10.20060mlcs4.x86_64.rpm
e570ffbbd17e30630e7f14a67b57cffd
corporate/4.0/x86_64/php-pcre-5.1.6-1.1.20060mlcs4.x86_64.rpm
c62fb74e0d8744077e4c8ff6f50df98b
corporate/4.0/SRPMS/php-5.1.6-1.10.20060mlcs4.src.rpm
e46cf717872ddfbf6a13f6d45d225533
corporate/4.0/SRPMS/php-curl-5.1.6-1.1.20060mlcs4.src.rpm
b188d26d6a781b5066d515ed5ae36ace
corporate/4.0/SRPMS/php-pcre-5.1.6-1.1.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFJd4y5mqjQ0CJFipgRAlpVAJ4oOl0atBrwZTu5WA3RvdNxzIDroACgi+UH
4tzIz9f+JcmDA5Q469nYg5M=
=804z
-----END PGP SIGNATURE-----