-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2014:115 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : php Date : June 10, 2014 Affected: Business Server 1.0 _______________________________________________________________________ Problem Description: Updated php packages fix security vulnerabilities: A flaw was found in the way file's Composite Document Files (CDF) format parser handle CDF files with many summary info entries. The cdf_unpack_summary_info() function unnecessarily repeatedly read the info from the same offset. This led to many file_printf() calls in cdf_file_property_info(), which caused file to use an excessive amount of CPU time when parsing a specially-crafted CDF file (CVE-2014-0237). A flaw was found in the way file parsed property information from Composite Document Files (CDF) files. A property entry with 0 elements triggers an infinite loop (CVE-2014-0238). PHP contains a bundled copy of the file utility's libmagic library, so it was vulnerable to this issue. It has been updated to the 5.5.13 version, which fixes this issue and several other bugs. Additionally, php-apc has been rebuilt against the updated php packages. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0237 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0238 http://advisories.mageia.org/MGASA-2014-0258.html http://www.php.net/ChangeLog-5.php#5.5.13 _______________________________________________________________________ Updated Packages: Mandriva Business Server 1/X86_64: 8711779e81a50a4904aa865b48524e29 mbs1/x86_64/apache-mod_php-5.5.13-1.mbs1.x86_64.rpm 5b6fa6fe481a7599d5c4e597c1d9bc66 mbs1/x86_64/lib64php5_common5-5.5.13-1.mbs1.x86_64.rpm d7595fc5c03fcda523a6b55ab356a208 mbs1/x86_64/php-apc-3.1.15-1.7.mbs1.x86_64.rpm 7d2e903f283e23fc24dc3a1ff4f74806 mbs1/x86_64/php-apc-admin-3.1.15-1.7.mbs1.x86_64.rpm e684cb737d10d699ac3ee8300158fb20 mbs1/x86_64/php-bcmath-5.5.13-1.mbs1.x86_64.rpm 0896588cd4d217382fe7edce11936b80 mbs1/x86_64/php-bz2-5.5.13-1.mbs1.x86_64.rpm 14e6355367c688176676f53e62981d12 mbs1/x86_64/php-calendar-5.5.13-1.mbs1.x86_64.rpm 19a4cc762f8b05ff9e0f9a489d630859 mbs1/x86_64/php-cgi-5.5.13-1.mbs1.x86_64.rpm 9f548d3786c32b85fff6bb51f25968df mbs1/x86_64/php-cli-5.5.13-1.mbs1.x86_64.rpm b8db5525d09f49a55b8e2b65d5de5769 mbs1/x86_64/php-ctype-5.5.13-1.mbs1.x86_64.rpm c17a7e419e090c6e87f6042e0a0d4df1 mbs1/x86_64/php-curl-5.5.13-1.mbs1.x86_64.rpm e298564d779b0ec06b1ebfed4afa4e8d mbs1/x86_64/php-dba-5.5.13-1.mbs1.x86_64.rpm 2b3e212dd4dd34bc7c018e43f3d8b2f7 mbs1/x86_64/php-devel-5.5.13-1.mbs1.x86_64.rpm ee061099f739a00b9b614c9c36893020 mbs1/x86_64/php-doc-5.5.13-1.mbs1.noarch.rpm b212b1fecde3a01d3cf9e428e5b94c22 mbs1/x86_64/php-dom-5.5.13-1.mbs1.x86_64.rpm eaec7f6df84daecc5e5f76b3d068b5e4 mbs1/x86_64/php-enchant-5.5.13-1.mbs1.x86_64.rpm 026b7278237e38d979f6cca904cedeaa mbs1/x86_64/php-exif-5.5.13-1.mbs1.x86_64.rpm 8c3bab218b68f119e81e4b32a88a3cf9 mbs1/x86_64/php-fileinfo-5.5.13-1.mbs1.x86_64.rpm bfba6c5ecb0ad7fca62d698e16bc591e mbs1/x86_64/php-filter-5.5.13-1.mbs1.x86_64.rpm ef0ad0dce52f6032ab818f8f116bb63c mbs1/x86_64/php-fpm-5.5.13-1.mbs1.x86_64.rpm 7fba1e0c6fd5966917a0ef29308320f6 mbs1/x86_64/php-ftp-5.5.13-1.mbs1.x86_64.rpm 9c5d684587774f46288190ebcb667a83 mbs1/x86_64/php-gd-5.5.13-1.mbs1.x86_64.rpm 3e50a38dc3647e63ca9f569043ddee4c mbs1/x86_64/php-gettext-5.5.13-1.mbs1.x86_64.rpm 7160d5a371b1d10938896b3a349bbbe7 mbs1/x86_64/php-gmp-5.5.13-1.mbs1.x86_64.rpm 6cdbb890f3bd4e79f294b93e01f056e3 mbs1/x86_64/php-hash-5.5.13-1.mbs1.x86_64.rpm aadfb4c1e93043956ac535756deeb484 mbs1/x86_64/php-iconv-5.5.13-1.mbs1.x86_64.rpm 55c55ab806e72434bb51f440af6e670a mbs1/x86_64/php-imap-5.5.13-1.mbs1.x86_64.rpm 6d8171c9e50dc93ffb96086888e18df6 mbs1/x86_64/php-ini-5.5.13-1.mbs1.x86_64.rpm 0ae0ae0fd51b352ded35e67d98945a21 mbs1/x86_64/php-intl-5.5.13-1.mbs1.x86_64.rpm d2a501a6fe260527dfcf9b7a1a10bf4a mbs1/x86_64/php-json-5.5.13-1.mbs1.x86_64.rpm b289596cfbff32fa727d1a6f1e4f91bc mbs1/x86_64/php-ldap-5.5.13-1.mbs1.x86_64.rpm ff980b8a060fee4f0b7f5cdbc1186487 mbs1/x86_64/php-mbstring-5.5.13-1.mbs1.x86_64.rpm 970047da4f0e8520a00b5f2ae8e5a2dd mbs1/x86_64/php-mcrypt-5.5.13-1.mbs1.x86_64.rpm 08cb4e6b70bb5d8c988b626c62d37510 mbs1/x86_64/php-mssql-5.5.13-1.mbs1.x86_64.rpm e1b13a6b4f448304d60568bdf390f74f mbs1/x86_64/php-mysql-5.5.13-1.mbs1.x86_64.rpm 756d526191c09b5c1163b648d2955399 mbs1/x86_64/php-mysqli-5.5.13-1.mbs1.x86_64.rpm 7ce3b6d6f5e05747c8dc29afd1dab49b mbs1/x86_64/php-mysqlnd-5.5.13-1.mbs1.x86_64.rpm 19dfa9eaececdd180f6a0f07347932cd mbs1/x86_64/php-odbc-5.5.13-1.mbs1.x86_64.rpm 8ca0d0b4b46cf1d37443a55b96e05754 mbs1/x86_64/php-opcache-5.5.13-1.mbs1.x86_64.rpm 2471c8af7a847b3d13c8a519fa78ed90 mbs1/x86_64/php-openssl-5.5.13-1.mbs1.x86_64.rpm 69b5a4852f380bd1f83f45021960fac4 mbs1/x86_64/php-pcntl-5.5.13-1.mbs1.x86_64.rpm 48b2a529902592be79fda68adf791ba1 mbs1/x86_64/php-pdo-5.5.13-1.mbs1.x86_64.rpm f490ec2b03038f9dfb07c7baf80b9664 mbs1/x86_64/php-pdo_dblib-5.5.13-1.mbs1.x86_64.rpm 9d3c2aadfc6b570c0e3a096214d44d52 mbs1/x86_64/php-pdo_mysql-5.5.13-1.mbs1.x86_64.rpm e996d335c93727f93f295dd5e7e62aea mbs1/x86_64/php-pdo_odbc-5.5.13-1.mbs1.x86_64.rpm edb94ed0076da44690b2bae5763bdc43 mbs1/x86_64/php-pdo_pgsql-5.5.13-1.mbs1.x86_64.rpm 4baddbb93b3f3762e418fab8ba8bd902 mbs1/x86_64/php-pdo_sqlite-5.5.13-1.mbs1.x86_64.rpm b21e5a3f672f8cc7ca952d0a38660f76 mbs1/x86_64/php-pgsql-5.5.13-1.mbs1.x86_64.rpm cd37ec13b2908d246ec96a22ad22faec mbs1/x86_64/php-phar-5.5.13-1.mbs1.x86_64.rpm 3683391016afb537b91b17113f8605c5 mbs1/x86_64/php-posix-5.5.13-1.mbs1.x86_64.rpm 7d318534a12a7a8ffbdabd79775c82f8 mbs1/x86_64/php-readline-5.5.13-1.mbs1.x86_64.rpm 4b631eb7e2c745751abfb58710e4562d mbs1/x86_64/php-recode-5.5.13-1.mbs1.x86_64.rpm 6a2ec65e4fad9af3cc8f8ba0f63a7aa9 mbs1/x86_64/php-session-5.5.13-1.mbs1.x86_64.rpm 883dc6088ec2f1c720b74327dffeef03 mbs1/x86_64/php-shmop-5.5.13-1.mbs1.x86_64.rpm ae0f47fb7c0f1e44b2ff5ec0fb3e8afc mbs1/x86_64/php-snmp-5.5.13-1.mbs1.x86_64.rpm a5b4e4b42414a9e2cdb21df3536e9f80 mbs1/x86_64/php-soap-5.5.13-1.mbs1.x86_64.rpm 60f2ff75f09c0cd16fc6b6aad1742ad6 mbs1/x86_64/php-sockets-5.5.13-1.mbs1.x86_64.rpm f8deb4a7555238285c37d4c60480958c mbs1/x86_64/php-sqlite3-5.5.13-1.mbs1.x86_64.rpm bde8d1303001a649802d4d3c370af035 mbs1/x86_64/php-sybase_ct-5.5.13-1.mbs1.x86_64.rpm 30854dc35b450154e23fbd1cd8ec48ed mbs1/x86_64/php-sysvmsg-5.5.13-1.mbs1.x86_64.rpm a2c8af3e1a951d36eaebf1b58b756376 mbs1/x86_64/php-sysvsem-5.5.13-1.mbs1.x86_64.rpm 6f0530e3ea94463b826f77da51b65963 mbs1/x86_64/php-sysvshm-5.5.13-1.mbs1.x86_64.rpm 7680c4d7bc14e8960954b23564a2a57c mbs1/x86_64/php-tidy-5.5.13-1.mbs1.x86_64.rpm d63c45b031eac0d51cfe42d445d33607 mbs1/x86_64/php-tokenizer-5.5.13-1.mbs1.x86_64.rpm aa1c71889b8e6a95be194f402cd659b2 mbs1/x86_64/php-wddx-5.5.13-1.mbs1.x86_64.rpm 12f25f419fa8652c55c1a47bd64e1853 mbs1/x86_64/php-xml-5.5.13-1.mbs1.x86_64.rpm 9ca69fe4dc9d28f9651c2f2448bfde43 mbs1/x86_64/php-xmlreader-5.5.13-1.mbs1.x86_64.rpm 7354023fdbe9c756fae68fb2649facdb mbs1/x86_64/php-xmlrpc-5.5.13-1.mbs1.x86_64.rpm 59f0f3169959c31adb8333f1e597a796 mbs1/x86_64/php-xmlwriter-5.5.13-1.mbs1.x86_64.rpm 35ff0c499c20239387daef7f60cec4c6 mbs1/x86_64/php-xsl-5.5.13-1.mbs1.x86_64.rpm bec63d966cc6b9e756272baf66815045 mbs1/x86_64/php-zip-5.5.13-1.mbs1.x86_64.rpm dc2e485d9587eb28a7b8b1915dd0f40c mbs1/x86_64/php-zlib-5.5.13-1.mbs1.x86_64.rpm 4c530928dfecb79e8de977555cb38f37 mbs1/SRPMS/php-5.5.13-1.mbs1.src.rpm cf24973b34d24e31942a1e04b63125c3 mbs1/SRPMS/php-apc-3.1.15-1.7.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFTlsPomqjQ0CJFipgRAg1qAJ0YBZob4nXqZms0MkA/1T74J2VLYgCfRsp6 cJwFAWk8ttlBXch5pCInVCs= =1IOZ -----END PGP SIGNATURE-----
