|
 |
| Problem Description |
A number of vulnerabilities in PHP versions prior to 4.3.10 were
discovered by Stefan Esser. Some of these vulnerabilities were not
deemed to be severe enough to warrant CVE names, however the packages
provided, with the exception of the Corporate Server 2.1 packages,
include fixes for all of the vulnerabilities, thanks to the efforts of
the OpenPKG team who extracted and backported the fixes.
The vulnerabilities fixed in all provided packages include a fix for
a possible information disclosure, double free, and negative reference
index array underflow in deserialization code (CAN-2004-1019). As
well, the exif_read_data() function suffers from an overflow on a long
sectionname; this vulnerability was discovered by Ilia Alshanetsky
(CAN-2004-1065).
The other fixes that appear in Mandrakelinux 9.2 and newer packages
include a fix for out of bounds memory write access in shmop_write()
and integer overflow/underflows in the pack() and unpack() functions.
The addslashes() function did not properly escape "" correctly. A
directory bypass issue existed in safe_mode execution. There is an
issue of arbitrary file access through path truncation. Finally, the
"magic_quotes_gpc" functionality could lead to one level directory
traversal with file uploads.
| Updated Packages |
Mandrakelinux 9.2
a2efac8a1ee14a3dcfa94c6f623a1b4c 9.2/RPMS/libphp_common432-4.3.3-2.3.92mdk.i586.rpm b85f3c02d2bba76ebbced0b64b369cd0 9.2/RPMS/php-cgi-4.3.3-2.3.92mdk.i586.rpm 0b3fca9527b45ee79ed2b8ba9c90b299 9.2/RPMS/php-cli-4.3.3-2.3.92mdk.i586.rpm cca3b9b83930e7a96dfe26114b0008a3 9.2/RPMS/php432-devel-4.3.3-2.3.92mdk.i586.rpm d55f284624ac1223f114c720eb7df18b 9.2/SRPMS/php-4.3.3-2.3.92mdk.src.rpm
Mandrakelinux 9.2/AMD64
0d9742db43fdcf601b2f58e7fbc2cc05 amd64/9.2/RPMS/lib64php_common432-4.3.3-2.3.92mdk.amd64.rpm 05bb8c70036b427d0a52015dafd20c80 amd64/9.2/RPMS/php-cgi-4.3.3-2.3.92mdk.amd64.rpm 8fe4fba4ccbd6a44667d368b0cd064ea amd64/9.2/RPMS/php-cli-4.3.3-2.3.92mdk.amd64.rpm 334c12194b2d22b3a97e2dbfab1acde4 amd64/9.2/RPMS/php432-devel-4.3.3-2.3.92mdk.amd64.rpm d55f284624ac1223f114c720eb7df18b amd64/9.2/SRPMS/php-4.3.3-2.3.92mdk.src.rpm
Mandrakelinux 10.0
06b5483f89fd3cf9950299b628adc000 10.0/RPMS/libphp_common432-4.3.4-4.3.100mdk.i586.rpm 475b1f1ccd3cf87eb5c6cea410c6b925 10.0/RPMS/php-cgi-4.3.4-4.3.100mdk.i586.rpm 5f74765dc38dda891ce56fa4b275cce1 10.0/RPMS/php-cli-4.3.4-4.3.100mdk.i586.rpm 0d96970f65d9d53dfbb56bef9c7cf920 10.0/RPMS/php432-devel-4.3.4-4.3.100mdk.i586.rpm 3d9fd1b025b49d8b064c785982d8491f 10.0/SRPMS/php-4.3.4-4.3.100mdk.src.rpm
Mandrakelinux 10.0/AMD64
a4302c774ce5e22e5910b1d1a130de3e amd64/10.0/RPMS/lib64php_common432-4.3.4-4.3.100mdk.amd64.rpm aced2cc932e30532ca0243aa3bb08d68 amd64/10.0/RPMS/php-cgi-4.3.4-4.3.100mdk.amd64.rpm 49893a1fab6fbcc7a2e315784a1917ed amd64/10.0/RPMS/php-cli-4.3.4-4.3.100mdk.amd64.rpm 3ae39ad55fcc27d41e5c98c49839151d amd64/10.0/RPMS/php432-devel-4.3.4-4.3.100mdk.amd64.rpm 3d9fd1b025b49d8b064c785982d8491f amd64/10.0/SRPMS/php-4.3.4-4.3.100mdk.src.rpm
Mandrakelinux 10.1
137904a75605f52241c384d2bc3b0c0c 10.1/RPMS/libphp_common432-4.3.8-3.2.101mdk.i586.rpm 1c9ca0459cdd747f528da02d6eca7452 10.1/RPMS/php-cgi-4.3.8-3.2.101mdk.i586.rpm 130d7a25c3a10398d993cef9319b29c8 10.1/RPMS/php-cli-4.3.8-3.2.101mdk.i586.rpm 2e4ba28a72bb6e178d06a5d85cd21948 10.1/RPMS/php432-devel-4.3.8-3.2.101mdk.i586.rpm db09ea993e41794e44bc843054232794 10.1/SRPMS/php-4.3.8-3.2.101mdk.src.rpm
Mandrakelinux 10.1/X86_64
a2ecb5c9c811a003a72200fe271ff1b2 x86_64/10.1/RPMS/lib64php_common432-4.3.8-3.2.101mdk.x86_64.rpm 24e125f79016925ef37e7a960482d7ee x86_64/10.1/RPMS/php-cgi-4.3.8-3.2.101mdk.x86_64.rpm 7f34cabe684c335fc8febad447d9973a x86_64/10.1/RPMS/php-cli-4.3.8-3.2.101mdk.x86_64.rpm ea97f3e1cfe9c56ce277bb59b36c559d x86_64/10.1/RPMS/php432-devel-4.3.8-3.2.101mdk.x86_64.rpm db09ea993e41794e44bc843054232794 x86_64/10.1/SRPMS/php-4.3.8-3.2.101mdk.src.rpm
Corporate Server 2.1
bd0081a43d13ab1df8bb0d277172f669 corporate/2.1/RPMS/php-4.2.3-4.3.C21mdk.i586.rpm 399d388aba15e1f848aea9a6e9829a39 corporate/2.1/RPMS/php-common-4.2.3-4.3.C21mdk.i586.rpm c28686b72864d3fdeace7cbe938dc1cc corporate/2.1/RPMS/php-devel-4.2.3-4.3.C21mdk.i586.rpm 7b65a50eb77e88581c916471d3b6ea1a corporate/2.1/RPMS/php-pear-4.2.3-4.3.C21mdk.i586.rpm 38d6e460a3372044d524cece0c9f426e corporate/2.1/SRPMS/php-4.2.3-4.3.C21mdk.src.rpm
Corporate Server 2.1/X86_64
3234c6addd5d8d854fda9e6ec415fed7 x86_64/corporate/2.1/RPMS/php-4.2.3-4.3.C21mdk.x86_64.rpm 43001648d6a67bfa204c8a6988572f78 x86_64/corporate/2.1/RPMS/php-common-4.2.3-4.3.C21mdk.x86_64.rpm fc41173cc7f6007168eacef722239151 x86_64/corporate/2.1/RPMS/php-devel-4.2.3-4.3.C21mdk.x86_64.rpm bd63181af60e3010cfac7ca096cbdff3 x86_64/corporate/2.1/RPMS/php-pear-4.2.3-4.3.C21mdk.x86_64.rpm 38d6e460a3372044d524cece0c9f426e x86_64/corporate/2.1/SRPMS/php-4.2.3-4.3.C21mdk.src.rpm
| References |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1064
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1063
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1019
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1018
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1065
http://www.php.net/release_4_3_10.php
http://www.hardened-php.net/advisories/012004.txt
| Upgrade |
To upgrade automatically, use MandrivaUpdate.
| Verification |
Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :
rpm --checksig package.rpm
You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.
If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.