Sicherheit: Denial of Service in PHP
Aktuelle Meldungen Distributionen
Name: Denial of Service in PHP
ID: FEDORA-2014-15053
Distribution: Fedora
Plattformen: Fedora 21
Datum: Sa, 6. Dezember 2014, 15:47
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3710
Applikationen: PHP


Name        : php
Product : Fedora 21
Version : 5.6.3
Release : 4.fc21
URL : http://www.php.net/
Summary : PHP scripting language for creating dynamic web sites
Description :
PHP is an HTML-embedded scripting language. PHP attempts to make it
easy for developers to write dynamically generated web pages. PHP also
offers built-in database integration for several commercial and
non-commercial database management systems, so writing a
database-enabled webpage with PHP is fairly simple. The most common
use of PHP coding is probably as a replacement for CGI scripts.

The php package contains the module (often referred to as mod_php)
which adds support for the PHP language to Apache HTTP Server.

Update Information:

13 Nov 2014, PHP 5.6.3

* Implemented 64-bit format codes for pack() and unpack(). (Leigh)
* Fixed bug #51800 (proc_open on Windows hangs forever). (Anatol)
* Fixed bug #67633 (A foreach on an array returned from a function not doing
copy-on-write). (Nikita)
* Fixed bug #67739 (Windows 8.1/Server 2012 R2 OS build number reported as 6.2
(instead of 6.3)). (Christian Wenz)
* Fixed bug #67949 (DOMNodeList elements should be accessible through array
notation) (Florian)
* Fixed bug #68095 (AddressSanitizer reports a heap buffer overflow in
php_getopt()). (Stas)
* Fixed bug #68118 ($a->foo .= 'test'; can leave $a->foo
undefined). (Nikita)
* Fixed bug #68129 (parse_url() - incomplete support for empty usernames and
passwords) (Tjerk)
* Fixed bug #68365 (zend_mm_heap corrupted after memory overflow in
zend_hash_copy). (Dmitry)

CURL_SSLVERSION_TLSv1_2 constants if supported by libcurl (Rasmus)

* Fixed bug #66242 (libmagic: don't assume char is signed). (ArdB)
* Fixed bug #68224 (buffer-overflow in libmagic/readcdf.c caught by
AddressSanitizer). (Remi)
* Fixed bug #68283 (fileinfo: out-of-bounds read in elf note headers).
(CVE-2014-3710) (Remi)

* Fixed bug #65641 (PHP-FPM incorrectly defines the SCRIPT_NAME variable when
using Apache, mod_proxy-fcgi and ProxyPass). (Remi)
* Implemented FR #55508 (listen and listen.allowed_clients should take IPv6
addresses). (Robin Gloster)

* Fixed bug #65171 (imagescale() fails without height param). (Remi)

* Implemented gmp_random_range() and gmp_random_bits(). (Leigh)
* Fixed bug #63595 (GMP memory management conflicts with other libraries using
GMP). (Remi)

* Fixed bug #68114 (linker error on some OS X machines with fixed width decimal
support) (Keyur Govande)

* Fixed bug #68087 (ODBC not correctly reading DATE column when preceded by a
VARCHAR column) (Keyur Govande)

* Fixed bug #68074 (Allow to use system cipher list instead of hardcoded
value). (Remi)

* Fixed bug #68199 (PDO::pgsqlGetNotify doesn't support NOTIFY payloads)
(Matteo, Alain Laporte)
* Fixed bug #66584 (Segmentation fault on statement deallocation) (Matteo)

* Fixed bug #68103 (Duplicate entry in Reflection for class alias). (Remi)

* Fixed bug #68128 (Regression in RecursiveRegexIterator) (Tjerk)

Backported from 5.6.4

* Fixed bug #68420 (listen=9000 listens to ipv6 localhost instead of all
addresses). (Remi)
* Fixed bug #68421 (access.format='%R' doesn't log ipv6 address).
* Fixed bug #68423 (PHP-FPM will no longer load all pools). (Remi)
* Fixed bug #68428 (listen.allowed_clients is IPv4 only). (Remi)

Packaging changes:
* fix case sensitivity for some timezones
* disable opcache.fast_shutdown in default config
* update fpm provided configuration from upstream (comments + missing


* Mon Nov 17 2014 Remi Collet <remi@fedoraproject.org> 5.6.3-4
- FPM: add upstream patch for https://bugs.php.net/68428
listen.allowed_clients is IPv4 only
* Mon Nov 17 2014 Remi Collet <remi@fedoraproject.org> 5.6.3-3
- sync php-fpm configuration with upstream
- refresh upstream patch for 68421
* Sun Nov 16 2014 Remi Collet <remi@fedoraproject.org> 5.6.3-2
- FPM: add upstream patch for https://bugs.php.net/68421
access.format=R doesn't log ipv6 address
- FPM: add upstream patch for https://bugs.php.net/68420
listen=9000 listens to ipv6 localhost instead of all addresses
- FPM: add upstream patch for https://bugs.php.net/68423
will no longer load all pools
* Thu Nov 13 2014 Remi Collet <remi@fedoraproject.org> 5.6.3-1
- Update to PHP 5.6.3
* Fri Oct 31 2014 Remi Collet <rcollet@redhat.com> 5.6.3-0.2.RC1
- php 5.6.3RC1 (refreshed, phpdbg changes reverted)
- new version of systzdata patch, fix case sensitivity
- ignore Factory in date tests
* Wed Oct 29 2014 Remi Collet <rcollet@redhat.com> 5.6.3-0.1.RC1
- php 5.6.3RC1
- disable opcache.fast_shutdown in default config
- enable phpdbg_webhelper new extension (in php-dbg)

This update can be installed with the "yum" update program. Use
su -c 'yum update php' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
package-announce mailing list
Neue Nachrichten