lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <20131212211813.E0B6F59CF6@kinkhorst.com> Date: Thu, 12 Dec 2013 22:18:13 +0100 (CET) From: Thijs Kinkhorst <thijs@...ian.org> To: debian-security-announce@...ts.debian.org Subject: [SECURITY] [DSA 2816-1] php5 security update -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2816-1 security@...ian.org http://www.debian.org/security/ Thijs Kinkhorst December 12, 2013 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : php5 Vulnerability : several Problem type : remote Debian-specific: no CVE ID : CVE-2013-6420 CVE-2013-6712 Debian Bug : 731112 731895 Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development. The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2013-6420 Stefan Esser reported possible memory corruption in openssl_x509_parse(). CVE-2013-6712 Creating DateInterval objects from parsed ISO dates was not properly restricted, which allowed to cause a denial of service. In addition, the update for Debian 7 "Wheezy" contains several bugfixes originally targeted for the upcoming Wheezy point release. For the oldstable distribution (squeeze), these problems have been fixed in version 5.3.3-7+squeeze18. For the stable distribution (wheezy), these problems have been fixed in version 5.4.4-14+deb7u7. For the unstable distribution (sid), these problems have been fixed in version 5.5.6+dfsg-2. We recommend that you upgrade your php5 packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: debian-security-announce@...ts.debian.org -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQEcBAEBAgAGBQJSqiIFAAoJEFb2GnlAHawEi9QH/1GwRze23Ebet++Lp83SCDpU 5RvM+0n+RuPbpJEJ0Tk+ta0uIj8uooS4nPODYqPspMVOw5vxPB7DzHB8CLYCfCjO SCBsPmNk8quDLSSvBvobRNOzALePrpzuEkuRMvatPS+EJ5Wtuw7rYc6bJu04GOJe FYYuarT+wK52jLYfSf8OE08SH323m9bIF/1lKkkFR1GmLd15cKPs3s6V2MD/Vb/5 tnhojbGEFXjKf7n19MHq0UYPCj6DUKQGM1er2t48iRY3TCpXtJ9YhUo034U+d51l 3/7rSVINnFfAB+DXN9GB90aQJ/I82ZHDqGaXJF61I/Yjk5/auxrqZEJTEbRup98= =gJk6 -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists