RH9 packages were updated to provide stripped binaries. RH7.3 packages are unchanged. --------------------------------------------------------------------- Fedora Legacy Test Update Notification FEDORALEGACY-2004-1868 Bugzilla https://bugzilla.fedora.us/show_bug.cgi?id=1868 2004-10-04 --------------------------------------------------------------------- Name : php Versions : 7.3: 4.1.2-7.3.10.legacy, 9: 4.2.2-17.7.legacy Summary : The PHP HTML-embedded scripting language. Description : PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated webpages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The mod_php module enables the Apache Web server to understand and process the embedded PHP language in Web pages. --------------------------------------------------------------------- Update Information: Stefan Esser discovered a flaw when memory_limit is enabled in versions of PHP 4 before 4.3.8. If a remote attacker could force the PHP interpreter to allocate more memory than the memory_limit setting before script execution begins, then the attacker may be able to supply the contents of a PHP hash table remotely. This hash table could then be used to execute arbitrary code as the 'apache' user. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0594 to this issue. This issue has a higher risk when PHP is running on an instance of Apache which is vulnerable to CAN-2004-0493. It may also be possible to exploit this issue if using a non-default PHP configuration with the "register_defaults" setting is changed to "On". Stefan Esser discovered a flaw in the strip_tags function in versions of PHP before 4.3.8. The strip_tags function is commonly used by PHP scripts to prevent Cross-Site-Scripting attacks by removing HTML tags from user-supplied form data. By embedding NUL bytes into form data, HTML tags can in some cases be passed intact through the strip_tags function, which may allow a Cross-Site-Scripting attack. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0595 to this issue. --------------------------------------------------------------------- 7.3 changelog: * Thu Sep 30 2004 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 4.1.2-7.3.10.legacy - Added missing BuildRequires: sendmail * Sun Aug 01 2004 John Dalbec <jpdalbec@xxxxxxx> 4.1.2-7.3.9.legacy - Added missing BuildRequires: flex mm-devel libtool * Mon Jul 26 2004 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 4.1.2-7.3.8.legacy - Added better security fix for CAN-2004-0594 - Added fixes for various compiler warnings * Thu Jul 15 2004 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 4.1.2-7.3.7.legacy - Added security fix for CAN-2004-0594 - Added security fix for CAN-2004-0595 - Added a few more fixes - Added imap-devel BuildRequires 9 changelog: * Sun Oct 03 2004 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 4.2.2-17.7.legacy - Rebuilt * Thu Sep 30 2004 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 4.2.2-17.6.legacy - Added sendmail to BuildRequires * Tue Sep 28 2004 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 4.2.2-17.5.legacy - Added flex and libtool to BuildRequires * Mon Jul 26 2004 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 4.2.2-17.4.legacy - Added better security fix for CAN-2004-0594 * Thu Jul 15 2004 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 4.2.2-17.3.legacy - Added security fix for CAN-2004-0594 - Added security fix for CAN-2004-0595 - Added a few more fixes --------------------------------------------------------------------- This update can be downloaded from: http://download.fedoralegacy.org/redhat/ (sha1sums) 6aaefdbf687f8dbf9ffc7b2ab0a0ff2914a13028 redhat/7.3/updates-testing/i386/php-4.1.2-7.3.10.legacy.i386.rpm 3f38e8929822edc377f61a05c31e45c8599a4ba6 redhat/7.3/updates-testing/i386/php-devel-4.1.2-7.3.10.legacy.i386.rpm 8c9ac5e7c5040b2d9cf75848acc1260842a5e4aa redhat/7.3/updates-testing/i386/php-imap-4.1.2-7.3.10.legacy.i386.rpm d01be5026d335032486eee9f91fdc72e43d78f54 redhat/7.3/updates-testing/i386/php-ldap-4.1.2-7.3.10.legacy.i386.rpm 20ed3b170959f47061fbf688bd0bf6c2380cee6c redhat/7.3/updates-testing/i386/php-manual-4.1.2-7.3.10.legacy.i386.rpm 66413adf5bf185326ea1658d837bbd34a4c2e59b redhat/7.3/updates-testing/i386/php-mysql-4.1.2-7.3.10.legacy.i386.rpm 5fd105b2b8e9aea72d4e34f4800218b40fe844b9 redhat/7.3/updates-testing/i386/php-odbc-4.1.2-7.3.10.legacy.i386.rpm 3c9152d075afc06ffb2ac64deeca3b331f3a6c06 redhat/7.3/updates-testing/i386/php-pgsql-4.1.2-7.3.10.legacy.i386.rpm 58027e3f2bd1485bae158cf99aebc63b631972ec redhat/7.3/updates-testing/i386/php-snmp-4.1.2-7.3.10.legacy.i386.rpm bd2e823603fab8b75a17647ac396263cc1ad6d7e redhat/7.3/updates-testing/SRPMS/php-4.1.2-7.3.10.legacy.src.rpm 594a4c87bf2b073b681b1c94a7bcf7ee7d5bc0dd redhat/9/updates-testing/i386/php-4.2.2-17.7.legacy.i386.rpm e1f076f96cfce7d687ad67f26f5e1c33f5993270 redhat/9/updates-testing/i386/php-devel-4.2.2-17.7.legacy.i386.rpm d349ace9d0a8514cd563217d56ef1f25261f2c92 redhat/9/updates-testing/i386/php-imap-4.2.2-17.7.legacy.i386.rpm 176e15f14ec6045aefd9c924dfa383c58598e16d redhat/9/updates-testing/i386/php-ldap-4.2.2-17.7.legacy.i386.rpm a6cda124e7a2de4083bec0a78f6758ab9f36a374 redhat/9/updates-testing/i386/php-manual-4.2.2-17.7.legacy.i386.rpm 42a87a54e0502721eec4907a8cb1c8db196c442a redhat/9/updates-testing/i386/php-mysql-4.2.2-17.7.legacy.i386.rpm 117bc0f478babf8317812fc35c763e8afeccca49 redhat/9/updates-testing/i386/php-odbc-4.2.2-17.7.legacy.i386.rpm c52bb318d8b217c02b61bd277f662a483e05e61b redhat/9/updates-testing/i386/php-pgsql-4.2.2-17.7.legacy.i386.rpm 6ec57d0958666d97532099d7f1118a52727db02b redhat/9/updates-testing/i386/php-snmp-4.2.2-17.7.legacy.i386.rpm 40e6bb2279a9154ecf0c313c39ab563c6de5a8ad redhat/9/updates-testing/SRPMS/php-4.2.2-17.7.legacy.src.rpm --------------------------------------------------------------------- Please test and comment in bugzilla. -- fedora-legacy-list@xxxxxxxxxx http://www.redhat.com/mailman/listinfo/fedora-legacy-list
