bugtraq - [ MDKSA-2006:091 ] - Updated php packages fix vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <E1Fj0Km-0005SK-Af@mercury.mandriva.com>
Date: Wed, 24 May 2006 14:52:00 -0600
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDKSA-2006:091 ] - Updated php packages fix vulnerabilities



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2006:091
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : php
 Date    : May 24, 2006
 Affected: 10.2, 2006.0, Corporate 3.0, Multi Network Firewall 2.0
 _______________________________________________________________________
 
 Problem Description:
 
 An integer overflow in the wordwrap() function could allow attackers
 to execute arbitrary code via certain long arguments that cause a small
 buffer to be allocated, triggering a heap-based buffer overflow
 (CVE-2006-1990).
 
 The substr_compare() function in PHP 5.x and 4.4.2 could allow
 attackers to cause a Denial of Service (memory access violation)
 via an out-of-bounds offset argument (CVE-2006-1991).
 
 The second vulnerability only affects Mandriva Linux 2006; earlier
 versions shipped with older versions of PHP that do not contain the
 substr_compare() function.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1990
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1991
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 10.2:
 463d4dd124e7e161159703976b35344d  10.2/RPMS/libphp_common432-4.3.10-7.12.102mdk.i586.rpm
 0a71e94de99b08ba787b23ef64c10357  10.2/RPMS/php432-devel-4.3.10-7.12.102mdk.i586.rpm
 cfcaf5c400bd4d7ca64a2ae25eccb0b7  10.2/RPMS/php-cgi-4.3.10-7.12.102mdk.i586.rpm
 321b4cad92d82d9bcd1f18170390f8ae  10.2/RPMS/php-cli-4.3.10-7.12.102mdk.i586.rpm
 1bf084222c4f33676432bfb516d71582  10.2/SRPMS/php-4.3.10-7.12.102mdk.src.rpm

 Mandriva Linux 10.2/X86_64:
 54243bc33bd55e326aa05f321f767442  x86_64/10.2/RPMS/lib64php_common432-4.3.10-7.12.102mdk.x86_64.rpm
 c1a6b0c185e4b39404493290cb80f86f  x86_64/10.2/RPMS/php432-devel-4.3.10-7.12.102mdk.x86_64.rpm
 b643924edc6d25dfeecdbb1cef532341  x86_64/10.2/RPMS/php-cgi-4.3.10-7.12.102mdk.x86_64.rpm
 d393dc26dadaadf34fc6b7b44ee46399  x86_64/10.2/RPMS/php-cli-4.3.10-7.12.102mdk.x86_64.rpm
 1bf084222c4f33676432bfb516d71582  x86_64/10.2/SRPMS/php-4.3.10-7.12.102mdk.src.rpm

 Mandriva Linux 2006.0:
 cbb4891a5ab88238d462a66e7363119e  2006.0/RPMS/libphp5_common5-5.0.4-9.9.20060mdk.i586.rpm
 dd77930acc185da44c6946252d445438  2006.0/RPMS/php-cgi-5.0.4-9.9.20060mdk.i586.rpm
 5de2486af340d1fe387f7ecafdf85df1  2006.0/RPMS/php-cli-5.0.4-9.9.20060mdk.i586.rpm
 6dd3b49d29cc28508ea3efdb69e72a79  2006.0/RPMS/php-devel-5.0.4-9.9.20060mdk.i586.rpm
 8e074aedcbd3126797bbe11c93e5bd04  2006.0/RPMS/php-fcgi-5.0.4-9.9.20060mdk.i586.rpm
 f144d3a41b04047b9d8c536a37aa94e1  2006.0/SRPMS/php-5.0.4-9.9.20060mdk.src.rpm

 Mandriva Linux 2006.0/X86_64:
 2e0821b3b925cc9c37391b061045c303  x86_64/2006.0/RPMS/lib64php5_common5-5.0.4-9.9.20060mdk.x86_64.rpm
 c0ad86b0b332c058a9a18f5a41aca912  x86_64/2006.0/RPMS/php-cgi-5.0.4-9.9.20060mdk.x86_64.rpm
 3c1ed4a2f1063fc53aec7a776af24939  x86_64/2006.0/RPMS/php-cli-5.0.4-9.9.20060mdk.x86_64.rpm
 855bd247b561da4284eacbab95432123  x86_64/2006.0/RPMS/php-devel-5.0.4-9.9.20060mdk.x86_64.rpm
 c504785298c305fd107ea6fdeff52211  x86_64/2006.0/RPMS/php-fcgi-5.0.4-9.9.20060mdk.x86_64.rpm
 f144d3a41b04047b9d8c536a37aa94e1  x86_64/2006.0/SRPMS/php-5.0.4-9.9.20060mdk.src.rpm

 Corporate 3.0:
 bb6a0d81b011c1f859fb741544154b07  corporate/3.0/RPMS/libphp_common432-4.3.4-4.16.C30mdk.i586.rpm
 e2d7f6bc462561ade323f97558491e8a  corporate/3.0/RPMS/php432-devel-4.3.4-4.16.C30mdk.i586.rpm
 61f46043b662e05c6eb33ab9ca28661a  corporate/3.0/RPMS/php-cgi-4.3.4-4.16.C30mdk.i586.rpm
 8ca7582e4edab0bf77f260247401d94d  corporate/3.0/RPMS/php-cli-4.3.4-4.16.C30mdk.i586.rpm
 b411e308d530cc2879b3087eb3f0f016  corporate/3.0/SRPMS/php-4.3.4-4.16.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 9cdb80932f1e0a551fe6e494b4fe7436  x86_64/corporate/3.0/RPMS/lib64php_common432-4.3.4-4.16.C30mdk.x86_64.rpm
 9027c979fa2b6b05917941f51c621a0a  x86_64/corporate/3.0/RPMS/php432-devel-4.3.4-4.16.C30mdk.x86_64.rpm
 b1fad86cb60c067daebba9383d033c84  x86_64/corporate/3.0/RPMS/php-cgi-4.3.4-4.16.C30mdk.x86_64.rpm
 d43daff0afa35122d1dfa29291b94fd3  x86_64/corporate/3.0/RPMS/php-cli-4.3.4-4.16.C30mdk.x86_64.rpm
 b411e308d530cc2879b3087eb3f0f016  x86_64/corporate/3.0/SRPMS/php-4.3.4-4.16.C30mdk.src.rpm

 Multi Network Firewall 2.0:
 9bb29e292e0f7612bd3ca38762262c85  mnf/2.0/RPMS/libphp_common432-4.3.4-4.16.M20mdk.i586.rpm
 9ad22ab66b3523d634dad69e126f7f44  mnf/2.0/RPMS/php432-devel-4.3.4-4.16.M20mdk.i586.rpm
 6d130a0f45e5a23b1134a2ef5a721995  mnf/2.0/RPMS/php-cgi-4.3.4-4.16.M20mdk.i586.rpm
 725f1e0d0fa61e2a912f2899225b6f87  mnf/2.0/RPMS/php-cli-4.3.4-4.16.M20mdk.i586.rpm
 29c7cfe26747e0fcd9168448e47dbc75  mnf/2.0/SRPMS/php-4.3.4-4.16.M20mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFEdJpOmqjQ0CJFipgRAvVuAJ9pXmScwuAXOfpLdFlGV7Juqw0h0ACfel1e
qWITtbmSuMA8sBfFscgwXrg=
=/EmR
-----END PGP SIGNATURE-----