FreshPorts - VuXML

A SUSE Security advisory reports:

A bug in the readfile() function of php4 could be used to to crash the httpd running the php4 code when accessing files with a multiple of the architectures page size leading to a denial of service.

< 4.3.5_7

< 4.3.5_7,1

A Secunia Advisory reports:

Some vulnerabilities have been reported in PHP, which can be exploited by malicious people to conduct cross-site scripting attacks, bypass certain security restrictions, and potentially compromise a vulnerable system.

< 4.4.1

ge 4 lt 4.4.1,1

Multiple vulnerabilities have been found in PHP, including: buffer overflows, stack overflows, format string, and information disclosure vulnerabilities.

The session extension contained safe_mode and open_basedir bypasses, but the FreeBSD Security Officer does not consider these real security vulnerabilities, since safe_mode and open_basedir are insecure by design and should not be relied upon.

< 5.2.1_2

< 4.4.5

ge 4 lt 4.4.5

ge 5 lt 5.2.1_2

Stefano Di Paola reports:

Bad array parsing in php_variables.c could lead to show arbitrary memory content such as pieces of php code and other data. This affects all GET, POST or COOKIES variables.

le 4.3.8_2

ge 4 le 4.3.8_2,1

le 5.0.1

le 5.0.1,1

Secunia reports:

Multiple vulnerabilities have been reported in PHP, which can be exploited to gain escalated privileges, bypass certain security restrictions, gain knowledge of sensitive information, or compromise a vulnerable system.

< 4.3.10

ge 4 lt 4.3.10,1

< 5.0.3

< 5.0.3,1

Stefan Esser of e-matters discovered a condition within PHP that may lead to remote execution of arbitrary code. The memory_limit facility is used to notify functions when memory contraints have been met. Under certain conditions, the entry into this facility is able to interrupt functions such as zend_hash_init() at locations not suitable for interruption. The result would leave these functions in a vulnerable state.

An attacker that is able to trigger the memory_limit abort within zend_hash_init() and is additionally able to control the heap before the HashTable itself is allocated, is able to supply his own HashTable destructor pointer. [...]

All mentioned places outside of the extensions are quite easy to exploit, because the memory allocation up to those places is deterministic and quite static throughout different PHP versions. [...]

Because the exploit itself consist of supplying an arbitrary destructor pointer this bug is exploitable on any platform.

le 4.3.7_3

le 4.3.7_3,1

le 5.0.0.r3_2

le 5.0.0.r3_2,1

Stefan Esser of e-matters discovered that PHP's strip_tags() function would ignore certain characters during parsing of tags, allowing these tags to pass through. Select browsers could then parse these tags, possibly allowing cross-site scripting attacks.

le 4.3.7_3

le 4.3.7_3,1

le 5.0.0.r3_2

le 5.0.0.r3_2,1

The PHP development team reports:

Security Enhancements and Fixes in PHP 5.2.2 and PHP 4.4.7:

• Fixed CVE-2007-1001, GD wbmp used with invalid image size
• Fixed asciiz byte truncation inside mail()
• Fixed a bug in mb_parse_str() that can be used to activate register_globals
• Fixed unallocated memory access/double free in in array_user_key_compare()
• Fixed a double free inside session_regenerate_id()
• Added missing open_basedir & safe_mode checks to zip:// and bzip:// wrappers.
• Limit nesting level of input variables with max_input_nesting_level as fix for.
• Fixed CRLF injection inside ftp_putcmd().
• Fixed a possible super-global overwrite inside import_request_variables().
• Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library.

Security Enhancements and Fixes in PHP 5.2.2 only:

• Fixed a header injection via Subject and To parameters to the mail() function
• Fixed wrong length calculation in unserialize S type.
• Fixed substr_compare and substr_count information leak.
• Fixed a remotely trigger-able buffer overflow inside make_http_soap_request().
• Fixed a buffer overflow inside user_filter_factory_create().

Security Enhancements and Fixes in PHP 4.4.7 only:

• XSS in phpinfo()

< 5.2.2

< 4.4.7

ge 4 lt 4.4.7

ge 5 lt 5.2.2