bugtraq - rPSA-2007-0176-1 gd php php-mysql php-pgsql php5 php5-cgi php5-mysql php5-pear php5-pgsql php5-soap php5-xsl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <46ded4a7.MQ2D5ZEHf3BYSBxw%announce-noreply@rpath.com>
Date: Wed, 05 Sep 2007 12:09:11 -0400
From: rPath Update Announcements <announce-noreply@...th.com>
To: security-announce@...ts.rpath.com,
	update-announce@...ts.rpath.com
Cc: full-disclosure@...ts.grok.org.uk, vulnwatch@...nwatch.org,
	bugtraq@...urityfocus.com, lwn@....net
Subject: rPSA-2007-0176-1 gd php php-mysql php-pgsql php5 php5-cgi
 php5-mysql php5-pear php5-pgsql php5-soap php5-xsl

rPath Security Advisory: 2007-0176-1
Published: 2007-09-05
Products: rPath Linux 1
Rating: Major
Exposure Level Classification:
    Indirect User Deterministic Unauthorized Access
Updated Versions:
    gd=/conary.rpath.com@rpl:devel//1/2.0.33-4.5-1
    php=/conary.rpath.com@rpl:devel//1/4.3.11-15.13-1
    php-mysql=/conary.rpath.com@rpl:devel//1/4.3.11-15.13-1
    php-pgsql=/conary.rpath.com@rpl:devel//1/4.3.11-15.13-1
    php5=/conary.rpath.com@rpl:1/5.2.3-7-1
    php5-cgi=/conary.rpath.com@rpl:1/5.2.3-7-1
    php5-mysql=/conary.rpath.com@rpl:1/5.2.3-7-1
    php5-pear=/conary.rpath.com@rpl:1/5.2.3-7-1
    php5-pgsql=/conary.rpath.com@rpl:1/5.2.3-7-1
    php5-soap=/conary.rpath.com@rpl:1/5.2.3-7-1
    php5-xsl=/conary.rpath.com@rpl:1/5.2.3-7-1

References:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3472
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3473
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3474
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3475
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3476
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3477
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3478
    https://issues.rpath.com/browse/RPL-1643

Description:
    Previous versions of the gd, php, and php5 packages are vulnerable
    to multiple attacks in which an attacker may cause unbounded CPU
    consumption or application crashes (Denial of Service), possibly
    leading to the execution of malicious code (Unauthorized Access).
    These attacks are generally limited to uses of the gd library to load
    existing images rather than generate new images.  Many applications
    that use gd (including all uses of gd within rPath Linux) us gd
    only for generating new images, not for loading existing images.
    
    While rPath Linux itself is not vulnerable to these attacks,
    some uses of gd, particularly when loading attacker-supplied
    images, will be vulnerable.  Some applications which use gd
    to load images supplied by remote users are web applications
    written in PHP.

Copyright 2007 rPath, Inc.
This file is distributed under the terms of the MIT License.
A copy is available at http://www.rpath.com/permanent/mit-license.html