full-disclosure - [ MDKSA-2006:180 ] - Updated php packages fix integer overflow vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu,  5 Oct 2006 16:24:00 -0600
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDKSA-2006:180 ] - Updated php packages fix
	integer overflow vulnerability


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2006:180
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : php
 Date    : October 5, 2006
 Affected: 2006.0, 2007.0
 _______________________________________________________________________
 
 Problem Description:
 
 An integer overflow was discovered in the PHP memory handling routines.
 If a script can cause memory allocation based on untrusted user data, a
 remote attacker sending a carefully crafted request could execute
 arbitrary code as the 'apache' user.

 Updated packages have been patched to correct these issues.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4812
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2006.0:
 6ac30c43d712db9447f2be74ddfaa40a  2006.0/i586/libphp5_common5-5.0.4-9.15.20060mdk.i586.rpm
 df476188754c1df5da3a86b91f8c1987  2006.0/i586/php-cgi-5.0.4-9.15.20060mdk.i586.rpm
 6a2593131e09a34423b3cbfa74edab9b  2006.0/i586/php-cli-5.0.4-9.15.20060mdk.i586.rpm
 20efe33389dbb5304d732d09dce04463  2006.0/i586/php-devel-5.0.4-9.15.20060mdk.i586.rpm
 db440436a40b6f253d751714506a3e0d  2006.0/i586/php-fcgi-5.0.4-9.15.20060mdk.i586.rpm 
 f1e6029968873eeaf58659e6f8f56f0f  2006.0/SRPMS/php-5.0.4-9.15.20060mdk.src.rpm

 Mandriva Linux 2006.0/X86_64:
 82c8b4eb0e5bb855227846f6d3398bf9  2006.0/x86_64/lib64php5_common5-5.0.4-9.15.20060mdk.x86_64.rpm
 bbd0ab99535516869b6e1eafdc4e13dd  2006.0/x86_64/php-cgi-5.0.4-9.15.20060mdk.x86_64.rpm
 a27aaaf58e981e0d3cc118dec0c51f67  2006.0/x86_64/php-cli-5.0.4-9.15.20060mdk.x86_64.rpm
 14388814a935ece2ca160d8423652dca  2006.0/x86_64/php-devel-5.0.4-9.15.20060mdk.x86_64.rpm
 73de1863d4d02010b2061414d980e360  2006.0/x86_64/php-fcgi-5.0.4-9.15.20060mdk.x86_64.rpm 
 f1e6029968873eeaf58659e6f8f56f0f  2006.0/SRPMS/php-5.0.4-9.15.20060mdk.src.rpm

 Mandriva Linux 2007.0:
 af43f53c775a56613baa08becc0ffd8e  2007.0/i586/libphp5_common5-5.1.6-1.1mdv2007.0.i586.rpm
 4a7616b81b7b44690d743fa731e10c77  2007.0/i586/php-cgi-5.1.6-1.1mdv2007.0.i586.rpm
 a37c23311a003f8736ec0a3b3b29fa63  2007.0/i586/php-cli-5.1.6-1.1mdv2007.0.i586.rpm
 c6d085ba649258ae2ab6d092be64cdff  2007.0/i586/php-devel-5.1.6-1.1mdv2007.0.i586.rpm
 8b2e2ab58f18a242ff3d2bc44859d144  2007.0/i586/php-fcgi-5.1.6-1.1mdv2007.0.i586.rpm 
 f43ef0b533e7844b8320bbb2862a7a3e  2007.0/SRPMS/php-5.1.6-1.1mdv2007.0.src.rpm

 Mandriva Linux 2007.0/X86_64:
 477c4dc57c253f33464a562ece238537  2007.0/x86_64/lib64php5_common5-5.1.6-1.1mdv2007.0.x86_64.rpm
 0e437323d4dc15f9445de8991a9b69c9  2007.0/x86_64/php-cgi-5.1.6-1.1mdv2007.0.x86_64.rpm
 75ffda1f5d0946401257f3f1f59c5c60  2007.0/x86_64/php-cli-5.1.6-1.1mdv2007.0.x86_64.rpm
 30094b00441d0af123bc6170f7945ea4  2007.0/x86_64/php-devel-5.1.6-1.1mdv2007.0.x86_64.rpm
 ed779aabad5448745c9ef23f0eab9d63  2007.0/x86_64/php-fcgi-5.1.6-1.1mdv2007.0.x86_64.rpm 
 f43ef0b533e7844b8320bbb2862a7a3e  2007.0/SRPMS/php-5.1.6-1.1mdv2007.0.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFFJVpLmqjQ0CJFipgRAjlfAJ9OV39Yb97us6c9vKFOiZwwaE3ZWwCffp49
1snZ5eKM19U4qu+Sb3Am4rs=
=6GRb
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/