Skip to Content.
Sympa Menu

sm-security - [SM-Security] PHP: Multiple vulnerabilities

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Elisamuel Resto <ryuji AT mages.ath.cx>
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] PHP: Multiple vulnerabilities
  • Date: Mon, 04 Jun 2007 14:46:49 -0400

Synopsis
========
PHP contains several vulnerabilities including buffer and integer overflows
which could under certain conditions lead to the remote execution of
arbitrary code.


Background
==========
PHP is a widely-used general-purpose scripting language that is especially
suited for Web development and can be embedded into HTML.


Description
===========
Several vulnerabilities were found in PHP, the most important being a
integer overflow inside chunk_split()[1], a possible infinite loop inside
the imagecreatefrompng() function[2], a CRLF injection vulnerability in the
FILTER_VALIDATE_EMAIL filter in ext/filter extension[3], a bypass to
open_basedir/safe_mod restrictions using the realpath() function[4], along
with a number of other bugs fixed for this release.


Notes
=====
There has been a change in the 'install' make target behaviour on how it
installs the CLI and CGI/FastCGI binaries. The CLI binary is now installed
as /usr/bin/php by default, and the CGI/FastCGI binary as /usr/bin/php-cgi.
This affects everybody using CGI or FastCGI as their backend for PHP in all
web servers.


Affected packages
=================
php versions less than 5.2.3 in all grimoires are affected.
This is now fixed in test, stable-rc and stable grimoire.


Resolution
==========
All php users should upgrade to the latest available version:
# scribe update
# cast -c php


References
==========
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2872
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2756
[3] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1900
[4] http://bugs.php.net/bug.php?id=41492

-- Elisamuel Resto <ryuji AT mages.ath.cx> General Guru / PHP Guru / Monkey
Wrench Source Mage GNU/Linux / GPG ID: 0x18615F19 B66D 1C2A E8EE B922
1D9C D98F D2D5 FB61 1861 5F19


Attachment: signature.asc
Description: OpenPGP digital signature



  • [SM-Security] PHP: Multiple vulnerabilities, Elisamuel Resto, 06/04/2007

Archive powered by MHonArc 2.6.24.

Top of Page