--------------------------------------------------------------------- Fedora Legacy Test Update Notification FEDORALEGACY-2005-2344 Bugzilla https://bugzilla.fedora.us/show_bug.cgi?id=2344 2005-02-17 ---------------------------------------------------------------------
Name : php Versions : rh7.3: php-4.1.2-7.3.13.legacy Versions : rh9: php-4.2.2-17.9.legacy Versions : fc1: php-4.3.8-1.4.legacy Summary : The PHP HTML-embedded scripting language. Description : PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated webpages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The mod_php module enables the Apache Web server to understand and process the embedded PHP language in Web pages.
--------------------------------------------------------------------- Update Information:
Updated php packages that fix various security issues are now available.
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.
An information disclosure bug was discovered in the parsing of "GPC" variables in PHP (query strings or cookies, and POST form data). If particular scripts used the values of the GPC variables, portions of the memory space of an httpd child process could be revealed to the client. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0958 to this issue.
A file access bug was discovered in the parsing of "multipart/form-data" forms, used by PHP scripts which allow file uploads. In particular configurations, some scripts could allow a malicious client to upload files to an arbitrary directory where the "apache" user has write access. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0959 to this issue.
Flaws were found in shmop_write, pack, and unpack PHP functions. These functions are not normally passed user supplied data, so would require a malicious PHP script to be exploited. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1018 to this issue.
Flaws including possible information disclosure, double free, and negative reference index array underflow were found in the deserialization code of PHP. PHP applications may use the unserialize function on untrusted user data, which could allow a remote attacker to gain access to memory or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1019 to this issue.
A flaw in the exif extension of PHP was found which lead to a stack overflow. An attacker could create a carefully crafted image file in such a way that if parsed by a PHP script using the exif extension it could cause a crash or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1065 to this issue.
Users of PHP should upgrade to these updated packages, which contain fixes for these issues.
---------------------------------------------------------------------
7.3 changelog:
* Mon Jan 31 2005 John Dalbec <jpdalbec@xxxxxxx> 4.1.2-7.3.13.legacy
- Fix typo in OpenPKG backport patch (filename -> filenamebuf)
- * Sun Jan 23 2005 Leonard den Ottolander <leonard * den ottolander nl> 4.1.2-7.3.11.legacy
- fix possible double-free in unserializer (CAN-2004-1019)
- fix integer overflows in pack() (CAN-2004-1018, requires
malicious script to exploit)
- Remove redundant CAN-2004-1018 sections from OpenPKG backport patch
* Wed Jan 05 2005 Pekka Savola <pekkas@xxxxxxxxxx> 4.1.2-6.3.12.legacy - Use a more complete patch, some parts had been left off by accident.
* Mon Jan 03 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 4.1.2-7.3.11.legacy
- Added OpenPKG patch backport for CAN-2004-1018, CAN-2004-1019, CAN-2004-1063,
CAN-2004-1064 and CAN-2004-1065
9 changelog: * Wed Dec 22 2004 Pekka Savola <pekkas@xxxxxxxxxx> 4.2.2-17.9.legacy - Replace the previous patches with a complete OpenPKG backport, fixing the issues (and more of them) more extensively.
* Tue Dec 21 2004 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 4.2.2-17.8.legacy
- Added security patches for CAN-2004-1019 and CAN-2004-1065
fc1 changelog:
* Fri Feb 11 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 4.3.8-1.4.legacy
- Added missing sendmail, w3c-libwww-devel and flex BuildRequires
* Mon Jan 03 2005 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 4.3.8-1.3.legacy
- Added patches for CAN-2004-0958 and CAN-2004-0959
* Tue Dec 21 2004 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 4.3.8-1.2.legacy
- Added OpenPKG patch for CAN-2004-1018, CAN-2004-1019, CAN-2004-1063,
CAN-2004-1064 and CAN-2004-1065
--------------------------------------------------------------------- This update can be downloaded from: http://download.fedoralegacy.org/ (sha1sums)
20ceb86ce6bfee68e7f6dc7e8512aa394a01a3ff redhat/7.3/updates-testing/i386/php-4.1.2-7.3.13.legacy.i386.rpm
5f4698e0e7f357b576b3be41c517ee6a271b67ef redhat/7.3/updates-testing/i386/php-devel-4.1.2-7.3.13.legacy.i386.rpm
3229575f1627cd90fd0e83ef1f59651734d7f896 redhat/7.3/updates-testing/i386/php-imap-4.1.2-7.3.13.legacy.i386.rpm
18a92f6fae26997069ce137ac5da2faa028e3d07 redhat/7.3/updates-testing/i386/php-ldap-4.1.2-7.3.13.legacy.i386.rpm
e7df41696b4a65769e8ffc61c64fd993421ded1e redhat/7.3/updates-testing/i386/php-manual-4.1.2-7.3.13.legacy.i386.rpm
394af4b551dc12e330623f8ea7ae81c26f19d1d6 redhat/7.3/updates-testing/i386/php-mysql-4.1.2-7.3.13.legacy.i386.rpm
f18d793145a92bddcc8a9ad12889634cab1dd1a7 redhat/7.3/updates-testing/i386/php-odbc-4.1.2-7.3.13.legacy.i386.rpm
65637930aae7002e74f173f137ad7ed5722cce71 redhat/7.3/updates-testing/i386/php-pgsql-4.1.2-7.3.13.legacy.i386.rpm
503acf37e5d2afa3eef1d9c1f4b2241316a9a4b0 redhat/7.3/updates-testing/i386/php-snmp-4.1.2-7.3.13.legacy.i386.rpm
cfe645d3341619ce5d8b64fe4d6041c7dd8f63dc redhat/7.3/updates-testing/SRPMS/php-4.1.2-7.3.13.legacy.src.rpm
2404b6151ce2d48fb52099670d05c23697fa1dc5 redhat/9/updates-testing/i386/php-4.2.2-17.9.legacy.i386.rpm
5ca9ec0eda28b7d40a6429ed67e70365fb718cef redhat/9/updates-testing/i386/php-devel-4.2.2-17.9.legacy.i386.rpm
c3d8bde9bc7eaa15f48918c4806f6078d72f2340 redhat/9/updates-testing/i386/php-imap-4.2.2-17.9.legacy.i386.rpm
28ff3b0b003a939c4b2ff55e3eea913b353489d3 redhat/9/updates-testing/i386/php-ldap-4.2.2-17.9.legacy.i386.rpm
5b8a789a09ed58ab09622a326949b375de105e61 redhat/9/updates-testing/i386/php-manual-4.2.2-17.9.legacy.i386.rpm
53daa8f099545603c5fb1e99c16f26e579f9efcf redhat/9/updates-testing/i386/php-mysql-4.2.2-17.9.legacy.i386.rpm
00e9f225ad329b03f93eb53230987329dabce2ba redhat/9/updates-testing/i386/php-odbc-4.2.2-17.9.legacy.i386.rpm
d98539ee8c8ec0c74300a2ebca09faece95e880f redhat/9/updates-testing/i386/php-pgsql-4.2.2-17.9.legacy.i386.rpm
c1b98df3b0dae17b795790601e9f588a9ae40d87 redhat/9/updates-testing/i386/php-snmp-4.2.2-17.9.legacy.i386.rpm
1ef77dcc2fa8670f61ef5ae8b6cbafeed8c984ee redhat/9/updates-testing/SRPMS/php-4.2.2-17.9.legacy.src.rpm
7952222f4a7741740e1b96596e88c294c4ca4a0b fedora/1/updates-testing/i386/php-4.3.8-1.4.legacy.i386.rpm
3c17207bda513e7113f5c3af7a9791c7c8b9f53b fedora/1/updates-testing/i386/php-devel-4.3.8-1.4.legacy.i386.rpm
a2ffa8a9252cb16b705974e07b5f5bfb08b2f18b fedora/1/updates-testing/i386/php-domxml-4.3.8-1.4.legacy.i386.rpm
f26692e01ee5ccfbbb99903ff591e3d502a1e8b7 fedora/1/updates-testing/i386/php-imap-4.3.8-1.4.legacy.i386.rpm
c42c6276460a5cd78b67a808f9fbfb71f5183130 fedora/1/updates-testing/i386/php-ldap-4.3.8-1.4.legacy.i386.rpm
14d898c1aa634bf0f4596ce06f3f8418b97247a1 fedora/1/updates-testing/i386/php-mbstring-4.3.8-1.4.legacy.i386.rpm
dba959ecf3a65f3b92246d3d22f15346ad681eff fedora/1/updates-testing/i386/php-mysql-4.3.8-1.4.legacy.i386.rpm
7f45350d2c16cc6af08472e29f1cd321a090ec46 fedora/1/updates-testing/i386/php-odbc-4.3.8-1.4.legacy.i386.rpm
0042f60f7b3aeb1b8599f2c7c17cbce77e2d0dce fedora/1/updates-testing/i386/php-pgsql-4.3.8-1.4.legacy.i386.rpm
dd8fc7d39d3f46d4c4467c1b4b3aa7ef9036ceca fedora/1/updates-testing/i386/php-snmp-4.3.8-1.4.legacy.i386.rpm
010e49a5ce6fe3ee33f399106c4bec93748bb7a7 fedora/1/updates-testing/i386/php-xmlrpc-4.3.8-1.4.legacy.i386.rpm
6df5177a5599bc58e9117a7b0e3bfda9366cf13e fedora/1/updates-testing/SRPMS/php-4.3.8-1.4.legacy.src.rpm
---------------------------------------------------------------------
Please test and comment in bugzilla.
Attachment:
signature.asc
Description: OpenPGP digital signature
-- fedora-legacy-list@xxxxxxxxxx http://www.redhat.com/mailman/listinfo/fedora-legacy-list
