-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

                 Mandrakelinux Security Update Advisory
 _______________________________________________________________________

 Package name:           php
 Advisory ID:            MDKSA-2004:068
 Date:                   July 14th, 2004

 Affected versions:	 10.0, 9.1, 9.2, Corporate Server 2.1,
			 Multi Network Firewall 8.2
 ______________________________________________________________________

 Problem Description:

 Stefan Esser discovered a remotely exploitable vulnerability in PHP
 where a remote attacker could trigger a memory_limit request
 termination in places where an interruption is unsafe.  This could be
 used to execute arbitrary code.
 
 As well, Stefan Esser also found a vulnerability in the handling of
 allowed tags within PHP's strip_tags() function.  This could lead to
 a number of XSS issues on sites that rely on strip_tags(); however,
 this only seems to affect the Internet Explorer and Safari browsers.
 
 The updated packages have been patched to correct the problem and
 all users are encouraged to upgrade immediately.
 _______________________________________________________________________

 References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0594
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0595
  http://security.e-matters.de/advisories/112004.html
  http://security.e-matters.de/advisories/122004.html
 ______________________________________________________________________

 Updated Packages:
  
 Mandrakelinux 10.0:
 62cdddfba4a6efda574d9a7fbade926a 
 10.0/RPMS/libphp_common432-4.3.4-4.1.100mdk.i586.rpm
 c71dc50bc4db1eef210dcdb17bfefb84  10.0/RPMS/php-cgi-4.3.4-4.1.100mdk.i586.rpm
 41ec866b7f9017e5e9697f758d96b7dd  10.0/RPMS/php-cli-4.3.4-4.1.100mdk.i586.rpm
 6cf53b4acfaf964f2ad27c26c7522850 
 10.0/RPMS/php432-devel-4.3.4-4.1.100mdk.i586.rpm
 805c5ba7b90fd4e53fc09b46d2e4c00c  10.0/SRPMS/php-4.3.4-4.1.100mdk.src.rpm

 Mandrakelinux 10.0/AMD64:
 8f7909d54dca79d0778754a78447c378 
 amd64/10.0/RPMS/lib64php_common432-4.3.4-4.1.100mdk.amd64.rpm
 378466839541330d72df496acc9cd9da 
 amd64/10.0/RPMS/php-cgi-4.3.4-4.1.100mdk.amd64.rpm
 3e6b698ba65fd6acb035d97f7c872c79 
 amd64/10.0/RPMS/php-cli-4.3.4-4.1.100mdk.amd64.rpm
 62693eda687695449ff61aee7af8b844 
 amd64/10.0/RPMS/php432-devel-4.3.4-4.1.100mdk.amd64.rpm
 805c5ba7b90fd4e53fc09b46d2e4c00c 
 amd64/10.0/SRPMS/php-4.3.4-4.1.100mdk.src.rpm

 Corporate Server 2.1:
 e1326fedc5957661efd6eec69c4e66cf 
 corporate/2.1/RPMS/php-4.2.3-4.2.C21mdk.i586.rpm
 31337953ddfec7c379c8bcad70e97f7f 
 corporate/2.1/RPMS/php-common-4.2.3-4.2.C21mdk.i586.rpm
 346f004bb741c5d3a279d495eadc61c5 
 corporate/2.1/RPMS/php-devel-4.2.3-4.2.C21mdk.i586.rpm
 91ef39ceeb256c72f449ebd2f73fdc3a 
 corporate/2.1/RPMS/php-pear-4.2.3-4.2.C21mdk.i586.rpm
 06a1c08156a866f9b78e1949df881425 
 corporate/2.1/SRPMS/php-4.2.3-4.2.C21mdk.src.rpm

 Corporate Server 2.1/x86_64:
 da53a0003ad75379dd473ca297c9b4f0 
 x86_64/corporate/2.1/RPMS/php-4.2.3-4.2.C21mdk.x86_64.rpm
 190da4dbf19fd83c3e8b2db3ebe7e186 
 x86_64/corporate/2.1/RPMS/php-common-4.2.3-4.2.C21mdk.x86_64.rpm
 7c32a33ced47f7feaf47f801718b6d8d 
 x86_64/corporate/2.1/RPMS/php-devel-4.2.3-4.2.C21mdk.x86_64.rpm
 0a747e5e17d82642f77cdfee44afe201 
 x86_64/corporate/2.1/RPMS/php-pear-4.2.3-4.2.C21mdk.x86_64.rpm
 06a1c08156a866f9b78e1949df881425 
 x86_64/corporate/2.1/SRPMS/php-4.2.3-4.2.C21mdk.src.rpm

 Mandrakelinux 9.1:
 53e9be87d1e87c11384c78e656fb045b 
 9.1/RPMS/libphp_common430-430-11.2.91mdk.i586.rpm
 d726c6e61503ace236d41e96dd2aacc4  9.1/RPMS/php-cgi-4.3.1-11.2.91mdk.i586.rpm
 c0f0638a6977b0747b9cef6421f0baa2  9.1/RPMS/php-cli-4.3.1-11.2.91mdk.i586.rpm
 846433aa57319fcf5ab760bb784c7f60 
 9.1/RPMS/php430-devel-430-11.2.91mdk.i586.rpm
 68d0872d095bdb4976541debcdaa11d7  9.1/SRPMS/php-4.3.1-11.2.91mdk.src.rpm

 Mandrakelinux 9.1/PPC:
 929514cf49ddeb4ac321b20ffa6fdb49 
 ppc/9.1/RPMS/libphp_common430-430-11.2.91mdk.ppc.rpm
 429cafb67ce1e36012eabad5c46d0a26 
 ppc/9.1/RPMS/php-cgi-4.3.1-11.2.91mdk.ppc.rpm
 0bab7923e30ccaf668a04b41925adc0b 
 ppc/9.1/RPMS/php-cli-4.3.1-11.2.91mdk.ppc.rpm
 af5f2be485dad26cb88103f3373a8188 
 ppc/9.1/RPMS/php430-devel-430-11.2.91mdk.ppc.rpm
 68d0872d095bdb4976541debcdaa11d7  ppc/9.1/SRPMS/php-4.3.1-11.2.91mdk.src.rpm

 Mandrakelinux 9.2:
 f731f578cdb9d458c4880a48f20c0027 
 9.2/RPMS/libphp_common432-4.3.3-2.1.92mdk.i586.rpm
 732ba08087b14490c057a9454c6b706d  9.2/RPMS/php-cgi-4.3.3-2.1.92mdk.i586.rpm
 d7aeca9053611e06ddeeb374ebc38fd5  9.2/RPMS/php-cli-4.3.3-2.1.92mdk.i586.rpm
 dfdbda0df15baea7861646b4c42eb1d2 
 9.2/RPMS/php432-devel-4.3.3-2.1.92mdk.i586.rpm
 8495c4332df4f8262d3f0b9b2b781739  9.2/SRPMS/php-4.3.3-2.1.92mdk.src.rpm

 Mandrakelinux 9.2/AMD64:
 7440678e5a938931b88953232c5c2a46 
 amd64/9.2/RPMS/lib64php_common432-4.3.3-2.1.92mdk.amd64.rpm
 4375a9c46be6b1ef103959253b469035 
 amd64/9.2/RPMS/php-cgi-4.3.3-2.1.92mdk.amd64.rpm
 3cd4c385732e3b31b9f20fa93b6a7ee5 
 amd64/9.2/RPMS/php-cli-4.3.3-2.1.92mdk.amd64.rpm
 dbf7471c02799c02a32e46a727ee87f3 
 amd64/9.2/RPMS/php432-devel-4.3.3-2.1.92mdk.amd64.rpm
 8495c4332df4f8262d3f0b9b2b781739  amd64/9.2/SRPMS/php-4.3.3-2.1.92mdk.src.rpm

 Multi Network Firewall 8.2:
 f91aac5bc43fa5c79317b8dd2d6fbfb2 
 mnf8.2/RPMS/php-common-4.1.2-1.3.M82mdk.i586.rpm
 9805edbc685f9418c54e9ea20f968b15  mnf8.2/SRPMS/php-4.1.2-1.3.M82mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrakeUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandrakesoft for security.  You can obtain
 the GPG public key of the Mandrakelinux Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandrakelinux at:

  http://www.mandrakesoft.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_linux-mandrake.com

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  <security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFA9b+NmqjQ0CJFipgRAgpzAKC+Hc4A1Z03TdP+VIUZGXhcu68NywCfeBVS
nfMtnYgAlOVkymEQmxRo7H8=
=EaFK
-----END PGP SIGNATURE-----


____________________________________________________
Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________