drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in php4
Name: |
Mehrere Probleme in php4 |
|
ID: |
MDVSA-2009:065 |
|
Distribution: |
Mandriva |
|
Plattformen: |
Mandriva Corporate 4.0 |
|
Datum: |
Do, 5. März 2009, 21:57 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4850
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5557
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0754 |
|
Applikationen: |
PHP |
|
Originalnachricht |
This is a multi-part message in MIME format...
------------=_1236286634-6173-2100
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2009:065 http://www.mandriva.com/security/ _______________________________________________________________________
Package : php4 Date : March 5, 2009 Affected: Corporate 4.0 _______________________________________________________________________
Problem Description:
A vulnerability in the cURL library in PHP allowed context-dependent attackers to bypass safe_mode and open_basedir restrictions and read arbitrary files using a special URL request (CVE-2007-4850). improve mbfl_filt_conv_html_dec_flush() error handling in ext/mbstring/libmbfl/filters/mbfilter_htmlent.c (CVE-2008-5557). PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server (CVE-2009-0754). The updated packages have been patched to correct these issues. _______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4850 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5557 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0754 _______________________________________________________________________
Updated Packages:
Corporate 4.0: 2dfd22f70a79140151e37ffc650ce562 corporate/4.0/i586/libphp4_common4-4.4.4-1.10.20060mlcs4.i586.rpm 1e7cfaacc2f0de74932c952002090c7e corporate/4.0/i586/php4-cgi-4.4.4-1.10.20060mlcs4.i586.rpm 70891521326ccf379ffcade515c07638 corporate/4.0/i586/php4-cli-4.4.4-1.10.20060mlcs4.i586.rpm e040b7271eeecdc71fa3d2bcb7da2bb6 corporate/4.0/i586/php4-curl-4.4.4-1.2.20060mlcs4.i586.rpm fe575f3f07a86d419eff519bde3510ea corporate/4.0/i586/php4-devel-4.4.4-1.10.20060mlcs4.i586.rpm 16fb016459d51d6455f0c51cd912efdb corporate/4.0/i586/php4-mbstring-4.4.4-1.2.20060mlcs4.i586.rpm 4059cd9721229c87b25b6e4743f13c48 corporate/4.0/SRPMS/php4-4.4.4-1.10.20060mlcs4.src.rpm 813154bf139d89573632a45437136e73 corporate/4.0/SRPMS/php4-curl-4.4.4-1.2.20060mlcs4.src.rpm 2df4a7ca570808691586f52452b5601e corporate/4.0/SRPMS/php4-mbstring-4.4.4-1.2.20060mlcs4.src.rpm
Corporate 4.0/X86_64: 8e35646c4b35628a85dd76a8f0473464 corporate/4.0/x86_64/lib64php4_common4-4.4.4-1.10.20060mlcs4.x86_64.rpm 448245361dff74604f72cbfe3f0273fc corporate/4.0/x86_64/php4-cgi-4.4.4-1.10.20060mlcs4.x86_64.rpm 377cc8202704396841dd767975373ac4 corporate/4.0/x86_64/php4-cli-4.4.4-1.10.20060mlcs4.x86_64.rpm cc6e7fb2188ab99c9f2fe4ee0ab07bfb corporate/4.0/x86_64/php4-curl-4.4.4-1.2.20060mlcs4.x86_64.rpm 98b50b1c01f816a916a24dac82bd45f4 corporate/4.0/x86_64/php4-devel-4.4.4-1.10.20060mlcs4.x86_64.rpm c8231e042b861977f9b17ba47b4bb8a7 corporate/4.0/x86_64/php4-mbstring-4.4.4-1.2.20060mlcs4.x86_64.rpm 4059cd9721229c87b25b6e4743f13c48 corporate/4.0/SRPMS/php4-4.4.4-1.10.20060mlcs4.src.rpm 813154bf139d89573632a45437136e73 corporate/4.0/SRPMS/php4-curl-4.4.4-1.2.20060mlcs4.src.rpm 2df4a7ca570808691586f52452b5601e corporate/4.0/SRPMS/php4-mbstring-4.4.4-1.2.20060mlcs4.src.rpm _______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com _______________________________________________________________________
Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFJsBH5mqjQ0CJFipgRAvR7AJ9n6eOS+uf+36UprPVysKAX1DjwLwCcCyWT bI3K5mTgfMbASwKq2f42QoU= =/crD -----END PGP SIGNATURE-----
------------=_1236286634-6173-2100 Content-Type: text/plain; name="message-footer.txt" Content-Disposition: inline; filename="message-footer.txt" Content-Transfer-Encoding: 8bit
To unsubscribe, send a email to sympa@mandrivalinux.org with this subject : unsubscribe security-announce _______________________________________________________ Want to buy your Pack or Services from Mandriva? Go to http://www.mandrivastore.com Join the Club : http://www.mandrivaclub.com _______________________________________________________
------------=_1236286634-6173-2100--
|
|
|
|