| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 14 Mar 2014 13:29:00 +0100 From: security@...driva.com To: full-disclosure@...ts.grok.org.uk Subject: [ MDVSA-2014:059 ] php -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2014:059 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : php Date : March 14, 2014 Affected: Business Server 1.0 _______________________________________________________________________ Problem Description: Multiple vulnerabilities has been discovered and corrected in php: Fixed bug #66731 (file: infinite recursion (CVE-2014-1943)). Fixed bug #66820 (out-of-bounds memory access in fileinfo (CVE-2014-2270)). Fixed bug #66815 (imagecrop(): insufficient fix for NULL defer (CVE-2013-7327)). The updated php packages have been upgraded to the 5.5.10 version which is not vulnerable to these issues. The php-xdebug packages has been upgraded to the latest 2.2.4 version that resolves numerous upstream bugs. Additionally, the PECL packages which requires so has been rebuilt for php-5.5.10. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1943 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2270 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7327 http://www.php.net/ChangeLog-5.php#5.5.10 https://bugs.php.net/bug.php?id=66731 https://bugs.php.net/bug.php?id=66820 https://bugs.php.net/bug.php?id=66815 http://pecl.php.net/package-changelog.php?package=xdebug&release=2.2.4 _______________________________________________________________________ Updated Packages: Mandriva Business Server 1/X86_64: 24737449ee336d5e9824e2f2ae543292 mbs1/x86_64/apache-mod_php-5.5.10-1.1.mbs1.x86_64.rpm 0b922c54fa9223fecc8d35a5c7c8599e mbs1/x86_64/lib64php5_common5-5.5.10-1.1.mbs1.x86_64.rpm 7ee561479c57d59fd98a5501e9586500 mbs1/x86_64/php-apc-3.1.15-1.4.mbs1.x86_64.rpm eb7de5759296f86517f5edfd9d4436ca mbs1/x86_64/php-apc-admin-3.1.15-1.4.mbs1.x86_64.rpm a1d9c94696da01a54ef8fdc514e87eeb mbs1/x86_64/php-bcmath-5.5.10-1.1.mbs1.x86_64.rpm 1b2cd506955bff2be731071a094c722f mbs1/x86_64/php-bz2-5.5.10-1.1.mbs1.x86_64.rpm 8960e53771c38895428275376133ad80 mbs1/x86_64/php-calendar-5.5.10-1.1.mbs1.x86_64.rpm 76ae075f4cb8bbd735289a6c1d06fd7a mbs1/x86_64/php-cgi-5.5.10-1.1.mbs1.x86_64.rpm 12b695df15e1f8cb7b0a4dfe6c9aa088 mbs1/x86_64/php-cli-5.5.10-1.1.mbs1.x86_64.rpm f8f5f6b8ed7afaffe4893ee713198f96 mbs1/x86_64/php-ctype-5.5.10-1.1.mbs1.x86_64.rpm 1950d33f015eefc8014070526758ee8e mbs1/x86_64/php-curl-5.5.10-1.1.mbs1.x86_64.rpm 9497d5da046377151644e93733cb074e mbs1/x86_64/php-dba-5.5.10-1.1.mbs1.x86_64.rpm ac662e5ef7059d81cccb62c7bbe97901 mbs1/x86_64/php-devel-5.5.10-1.1.mbs1.x86_64.rpm 87a743ba4947af120c24da6115c7e6db mbs1/x86_64/php-doc-5.5.10-1.1.mbs1.noarch.rpm b941027ff5051dc2811b4263f6bf20b1 mbs1/x86_64/php-dom-5.5.10-1.1.mbs1.x86_64.rpm 77c456007f9d6e330bfa514dc7e2c71c mbs1/x86_64/php-enchant-5.5.10-1.1.mbs1.x86_64.rpm e14bbbfe6cbd0027eb92f2de676bda2b mbs1/x86_64/php-exif-5.5.10-1.1.mbs1.x86_64.rpm 016db3c40dafc614f69ed163870d0ba9 mbs1/x86_64/php-fileinfo-5.5.10-1.1.mbs1.x86_64.rpm 800722c1127bf7f835fed88d5805612a mbs1/x86_64/php-filter-5.5.10-1.1.mbs1.x86_64.rpm c25709c616879f64ca095493a250e49a mbs1/x86_64/php-fpm-5.5.10-1.1.mbs1.x86_64.rpm dd3b14133c3e5e299976709acaba36f1 mbs1/x86_64/php-ftp-5.5.10-1.1.mbs1.x86_64.rpm 33285cc7d2f89640c84a89c2d78d4c1c mbs1/x86_64/php-gd-5.5.10-1.1.mbs1.x86_64.rpm 98815ed19f6a439995c257c86d3fd8e7 mbs1/x86_64/php-gettext-5.5.10-1.1.mbs1.x86_64.rpm 2c34c8d28d2bcf105deced29a743ce10 mbs1/x86_64/php-gmp-5.5.10-1.1.mbs1.x86_64.rpm 66f17761f797c9ba5b9f64359df0e444 mbs1/x86_64/php-hash-5.5.10-1.1.mbs1.x86_64.rpm a9679cf58298c91fe11e9065888f3ecf mbs1/x86_64/php-iconv-5.5.10-1.1.mbs1.x86_64.rpm 44c8fd8cbd7a749ce405eafcb5cfaba0 mbs1/x86_64/php-imap-5.5.10-1.1.mbs1.x86_64.rpm de60f25c3e3da02a1ed96ea3c6b7d146 mbs1/x86_64/php-ini-5.5.10-1.1.mbs1.x86_64.rpm 674171b2daf508b7709ec0fa39f3dadb mbs1/x86_64/php-intl-5.5.10-1.1.mbs1.x86_64.rpm b4b75e252c03be45e1ea42d93cbb559d mbs1/x86_64/php-json-5.5.10-1.1.mbs1.x86_64.rpm 10071e1f44d3ec6500559211168c3b4a mbs1/x86_64/php-ldap-5.5.10-1.1.mbs1.x86_64.rpm 4b7e7d0a0b6adcca257a2fd124e62c58 mbs1/x86_64/php-mbstring-5.5.10-1.1.mbs1.x86_64.rpm 19345fe51062884bd7c9ff80f49dcbdb mbs1/x86_64/php-mcrypt-5.5.10-1.1.mbs1.x86_64.rpm e2a844b656f9ab03b731ad2f272b5d2b mbs1/x86_64/php-mssql-5.5.10-1.1.mbs1.x86_64.rpm 4fcf706c941176818fdfc995fba8209c mbs1/x86_64/php-mysql-5.5.10-1.1.mbs1.x86_64.rpm 46c3635f1e79e351b2d63d7be993557b mbs1/x86_64/php-mysqli-5.5.10-1.1.mbs1.x86_64.rpm 6b652b39093992140614a97e4633ee52 mbs1/x86_64/php-mysqlnd-5.5.10-1.1.mbs1.x86_64.rpm d8712b4ec5533dd53c3e1a6854a41612 mbs1/x86_64/php-odbc-5.5.10-1.1.mbs1.x86_64.rpm 58da4457f76d98468fbc2216a82a6210 mbs1/x86_64/php-opcache-5.5.10-1.1.mbs1.x86_64.rpm 67847c07b4d21ef262864d25a633d70a mbs1/x86_64/php-openssl-5.5.10-1.1.mbs1.x86_64.rpm daf97d8271493a2ecbd18ad20a857bcf mbs1/x86_64/php-pcntl-5.5.10-1.1.mbs1.x86_64.rpm 4a6aed5d64de832c986caa41d4a99919 mbs1/x86_64/php-pdo-5.5.10-1.1.mbs1.x86_64.rpm 38358c84106e4f5c86704c92f09a4852 mbs1/x86_64/php-pdo_dblib-5.5.10-1.1.mbs1.x86_64.rpm f5f013d46693b257672a53333c1d2aef mbs1/x86_64/php-pdo_mysql-5.5.10-1.1.mbs1.x86_64.rpm a052eca4ad1c2fa1aa2cc5a492864959 mbs1/x86_64/php-pdo_odbc-5.5.10-1.1.mbs1.x86_64.rpm e5e592546df1d334c3bd8e26be14784e mbs1/x86_64/php-pdo_pgsql-5.5.10-1.1.mbs1.x86_64.rpm bfe91133e7dd8ecd326d033f09156fd5 mbs1/x86_64/php-pdo_sqlite-5.5.10-1.1.mbs1.x86_64.rpm cec3e2d7281150e42c138375c7047392 mbs1/x86_64/php-pgsql-5.5.10-1.1.mbs1.x86_64.rpm 45a7eefb527a69d733e121d6814e4294 mbs1/x86_64/php-phar-5.5.10-1.1.mbs1.x86_64.rpm 093b385f0d0b46e3f6fd33f914548a0a mbs1/x86_64/php-posix-5.5.10-1.1.mbs1.x86_64.rpm 5864c26cd75dbe4f3c78b369081f0438 mbs1/x86_64/php-readline-5.5.10-1.1.mbs1.x86_64.rpm d0f41537a40bd91a5f1f3a8ca5fde200 mbs1/x86_64/php-recode-5.5.10-1.1.mbs1.x86_64.rpm ad5ab348291e6b2e5a4eb3bb33ce8a2f mbs1/x86_64/php-session-5.5.10-1.1.mbs1.x86_64.rpm cf9882756cfc5ca36ceffe23a148bb47 mbs1/x86_64/php-shmop-5.5.10-1.1.mbs1.x86_64.rpm 74b1621ca81142e93046925bed22a5e8 mbs1/x86_64/php-snmp-5.5.10-1.1.mbs1.x86_64.rpm 80e3ba9497626214b3bcc2712f60ac5f mbs1/x86_64/php-soap-5.5.10-1.1.mbs1.x86_64.rpm 9de06a2dee1e54d7f42a33a17ca8205b mbs1/x86_64/php-sockets-5.5.10-1.1.mbs1.x86_64.rpm c030bff618bbcb037e812ddb94649eb5 mbs1/x86_64/php-sqlite3-5.5.10-1.1.mbs1.x86_64.rpm b65a0c3e62630b815656e80da43a2480 mbs1/x86_64/php-sybase_ct-5.5.10-1.1.mbs1.x86_64.rpm be0694c255784a0a4f35f0e8d15f201b mbs1/x86_64/php-sysvmsg-5.5.10-1.1.mbs1.x86_64.rpm 80ad06376f143a770cfb5cba1d848af2 mbs1/x86_64/php-sysvsem-5.5.10-1.1.mbs1.x86_64.rpm 20ee2f4ab2344649920c7ea75d251229 mbs1/x86_64/php-sysvshm-5.5.10-1.1.mbs1.x86_64.rpm 756a95f3f9caf872ca3e656ae2c8f6e1 mbs1/x86_64/php-tidy-5.5.10-1.1.mbs1.x86_64.rpm ea69b8f0630a5016589c5340e9f8cb08 mbs1/x86_64/php-tokenizer-5.5.10-1.1.mbs1.x86_64.rpm 9120358796e07a057bcb49b3f7a3287a mbs1/x86_64/php-wddx-5.5.10-1.1.mbs1.x86_64.rpm 140204bf0eb22cbaa71392c87217730b mbs1/x86_64/php-xdebug-2.2.4-1.mbs1.x86_64.rpm d8f2b85bd082332a608612deeee0a527 mbs1/x86_64/php-xml-5.5.10-1.1.mbs1.x86_64.rpm 1373b28914b0e1fc52d98e8599ab5286 mbs1/x86_64/php-xmlreader-5.5.10-1.1.mbs1.x86_64.rpm 24767241f254b25cf40f22c5b42009d4 mbs1/x86_64/php-xmlrpc-5.5.10-1.1.mbs1.x86_64.rpm ebe5805c7fc2ba228019f461f666d53f mbs1/x86_64/php-xmlwriter-5.5.10-1.1.mbs1.x86_64.rpm d8e5137af8780fb2aa1588d926ea5214 mbs1/x86_64/php-xsl-5.5.10-1.1.mbs1.x86_64.rpm 8e7ec6219aa8ec67b7e34752266fd0c3 mbs1/x86_64/php-zip-5.5.10-1.1.mbs1.x86_64.rpm 02eaebe931a02fa3b7aeee6f90078b59 mbs1/x86_64/php-zlib-5.5.10-1.1.mbs1.x86_64.rpm d32d95daec74ca968d0143f9bb4c39aa mbs1/SRPMS/php-5.5.10-1.1.mbs1.src.rpm cef70e625abea16578f7234743896bae mbs1/SRPMS/php-apc-3.1.15-1.4.mbs1.src.rpm 015ce9f2892ee94a3a73a8a15bdc58fd mbs1/SRPMS/php-xdebug-2.2.4-1.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFTIsvKmqjQ0CJFipgRApfjAKDHpy/8XvFn1A9/+/8RG+R6WCKbiwCfdgcv HD1vXz3eegn3ApmAVUKBfiE= =+nza -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists