Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in php4
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in php4
ID: MDVSA-2009:065
Distribution: Mandriva
Plattformen: Mandriva Corporate 4.0
Datum: Do, 5. März 2009, 21:57
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4850
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5557
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0754
Applikationen: PHP

Originalnachricht

This is a multi-part message in MIME format...

------------=_1236286634-6173-2100


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2009:065
http://www.mandriva.com/security/
_______________________________________________________________________

Package : php4
Date : March 5, 2009
Affected: Corporate 4.0
_______________________________________________________________________

Problem Description:

A vulnerability in the cURL library in PHP allowed context-dependent
attackers to bypass safe_mode and open_basedir restrictions and read
arbitrary files using a special URL request (CVE-2007-4850).

improve mbfl_filt_conv_html_dec_flush() error handling in
ext/mbstring/libmbfl/filters/mbfilter_htmlent.c (CVE-2008-5557).

PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows
local users to modify behavior of other sites hosted on the same
web server by modifying the mbstring.func_overload setting within
.htaccess, which causes this setting to be applied to other virtual
hosts on the same server (CVE-2009-0754).

The updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4850
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5557
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0754
_______________________________________________________________________

Updated Packages:

Corporate 4.0:
2dfd22f70a79140151e37ffc650ce562
corporate/4.0/i586/libphp4_common4-4.4.4-1.10.20060mlcs4.i586.rpm
1e7cfaacc2f0de74932c952002090c7e
corporate/4.0/i586/php4-cgi-4.4.4-1.10.20060mlcs4.i586.rpm
70891521326ccf379ffcade515c07638
corporate/4.0/i586/php4-cli-4.4.4-1.10.20060mlcs4.i586.rpm
e040b7271eeecdc71fa3d2bcb7da2bb6
corporate/4.0/i586/php4-curl-4.4.4-1.2.20060mlcs4.i586.rpm
fe575f3f07a86d419eff519bde3510ea
corporate/4.0/i586/php4-devel-4.4.4-1.10.20060mlcs4.i586.rpm
16fb016459d51d6455f0c51cd912efdb
corporate/4.0/i586/php4-mbstring-4.4.4-1.2.20060mlcs4.i586.rpm
4059cd9721229c87b25b6e4743f13c48
corporate/4.0/SRPMS/php4-4.4.4-1.10.20060mlcs4.src.rpm
813154bf139d89573632a45437136e73
corporate/4.0/SRPMS/php4-curl-4.4.4-1.2.20060mlcs4.src.rpm
2df4a7ca570808691586f52452b5601e
corporate/4.0/SRPMS/php4-mbstring-4.4.4-1.2.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
8e35646c4b35628a85dd76a8f0473464
corporate/4.0/x86_64/lib64php4_common4-4.4.4-1.10.20060mlcs4.x86_64.rpm
448245361dff74604f72cbfe3f0273fc
corporate/4.0/x86_64/php4-cgi-4.4.4-1.10.20060mlcs4.x86_64.rpm
377cc8202704396841dd767975373ac4
corporate/4.0/x86_64/php4-cli-4.4.4-1.10.20060mlcs4.x86_64.rpm
cc6e7fb2188ab99c9f2fe4ee0ab07bfb
corporate/4.0/x86_64/php4-curl-4.4.4-1.2.20060mlcs4.x86_64.rpm
98b50b1c01f816a916a24dac82bd45f4
corporate/4.0/x86_64/php4-devel-4.4.4-1.10.20060mlcs4.x86_64.rpm
c8231e042b861977f9b17ba47b4bb8a7
corporate/4.0/x86_64/php4-mbstring-4.4.4-1.2.20060mlcs4.x86_64.rpm
4059cd9721229c87b25b6e4743f13c48
corporate/4.0/SRPMS/php4-4.4.4-1.10.20060mlcs4.src.rpm
813154bf139d89573632a45437136e73
corporate/4.0/SRPMS/php4-curl-4.4.4-1.2.20060mlcs4.src.rpm
2df4a7ca570808691586f52452b5601e
corporate/4.0/SRPMS/php4-mbstring-4.4.4-1.2.20060mlcs4.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJsBH5mqjQ0CJFipgRAvR7AJ9n6eOS+uf+36UprPVysKAX1DjwLwCcCyWT
bI3K5mTgfMbASwKq2f42QoU=
=/crD
-----END PGP SIGNATURE-----


------------=_1236286634-6173-2100
Content-Type: text/plain; name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://www.mandrivastore.com
Join the Club : http://www.mandrivaclub.com
_______________________________________________________

------------=_1236286634-6173-2100--
Pro-Linux
Traut euch!
Neue Nachrichten
Werbung