Date: Fri, 21 Sep 2007 17:17:14 -0600
From: [email protected]Subject: [ MDKSA-2007:187 ] - Updated PHP packages fix numerous vulnerabilities
To: [email protected]
Reply-To: [email protected]
Message-id: <E1IYrkI-0003eA-Io@artemis.annvix.ca.>
X-SA-Exim-Connect-IP: 10.0.5.11
X-SA-Exim-Mail-From: [email protected]
X-SA-Exim-Version: 4.2.1 (built Fri, 02 Feb 2007 19:02:33 -0700)
X-SA-Exim-Scanned: Yes (on hades.annvix.org)
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2007:187
http://www.mandriva.com/security/
_______________________________________________________________________
Package : php
Date : September 21, 2007
Affected: 2007.0, 2007.1, Corporate 3.0, Corporate 4.0,
Multi Network Firewall 2.0
_______________________________________________________________________
Problem Description:
Numerous vulnerabilities were discovered in the PHP scripting language
that are corrected with this update.
An integer overflow in the substr_compare() function allows
context-dependent attackers to read sensitive memory via a large
value in the length argument. This only affects PHP5 (CVE-2007-1375).
A stack-based buffer overflow in the zip:// URI wrapper in PECL
ZIP 1.8.3 and earlier allowes remote attackers to execute arbitrary
code via a long zip:// URL. This only affects Corporate Server 4.0
(CVE-2007-1399).
A CRLF injection vulnerability in the FILTER_VALIDATE_EMAIL filter
could allow an attacker to inject arbitrary email headers via a
special email address. This only affects Mandriva Linux 2007.1
(CVE-2007-1900).
The mcrypt_create_iv() function calls php_rand_r() with an
uninitialized seed variable, thus always generating the same
initialization vector, which may allow an attacker to decrypt
certain data more easily because of the guessable encryption keys
(CVE-2007-2727).
The soap extension calls php_rand_r() with an uninitialized seec
variable, which has unknown impact and attack vectors; an issue
similar to that affecting mcrypt_create_iv(). This only affects PHP5
(CVE-2007-2728).
The substr_count() function allows attackers to obtain sensitive
information via unspecified vectors. This only affects PHP5
(CVE-2007-2748).
An infinite loop was found in the gd extension that could be used to
cause a denial of service if a script were forced to process certain
PNG images from untrusted sources (CVE-2007-2756).
An integer overflow flaw was found in the chunk_split() function that
ould possibly execute arbitrary code as the apache user if a remote
attacker was able to pass arbitrary data to the third argument of
chunk_split() (CVE-2007-2872).
A flaw in the PHP session cookie handling could allow an attacker to
create a cross-site cookie insertion attack if a victim followed an
untrusted carefully-crafted URL (CVE-2007-3799).
Various integer overflow flaws were discovered in the PHP gd extension
that could allow a remote attacker to execute arbitrary code as the
apache user (CVE-2007-3996).
A flaw in the wordwrap() frunction could result in a denial of ervice
if a remote attacker was able to pass arbitrary data to the function
(CVE-2007-3998).
A flaw in the money_format() function could result in an information
leak or denial of service if a remote attacker was able to pass
arbitrary data to this function; this situation would be unlikely
however (CVE-2007-4658).
A bug in the PHP session cookie handling could allow an attacker to
stop a victim from viewing a vulnerable website if the victim first
visited a malicious website under the control of the attacker who
was able to use that page to set a cookie for the vulnerable website
(CVE-2007-4670).
Updated packages have been patched to prevent these issues.
In addition, PECL ZIP version 1.8.10 is being provided for Corporate
Server 4.0.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1375http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1399http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1900http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2727http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2728http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2748http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2756http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2872http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3799http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3996http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3998http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4658http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4670
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2007.0:
57a68f47fd8c691db93b9eadbbf19b40 2007.0/i586/libphp5_common5-5.1.6-1.9mdv2007.0.i586.rpm
f82d39f70da087f4d7f9470f81211276 2007.0/i586/php-cgi-5.1.6-1.9mdv2007.0.i586.rpm
a22e66bf85ab53ff1782ce331ffa60a6 2007.0/i586/php-cli-5.1.6-1.9mdv2007.0.i586.rpm
c3cd07dba2182b4f583794a3b240e84e 2007.0/i586/php-devel-5.1.6-1.9mdv2007.0.i586.rpm
265ef0003e043ad3013022b1e566fd89 2007.0/i586/php-fcgi-5.1.6-1.9mdv2007.0.i586.rpm
598e110d6abcc345a0b6ee1676214ee2 2007.0/i586/php-gd-5.1.6-1.3mdv2007.0.i586.rpm
0f9a486f5ccadd55c81aa61705ae5d81 2007.0/i586/php-mcrypt-5.1.6-1.1mdv2007.0.i586.rpm
6d7d80d3cdeae2e4ca286b67be659cef 2007.0/i586/php-soap-5.1.6-1.2mdv2007.0.i586.rpm
06fef845a7f0eb15fbda8e01d2449759 2007.0/SRPMS/php-5.1.6-1.9mdv2007.0.src.rpm
1c4c5379d367dd0ba8c002d2a60eb8b1 2007.0/SRPMS/php-gd-5.1.6-1.3mdv2007.0.src.rpm
4b4382448f9be55ea66f8b910a12a97c 2007.0/SRPMS/php-mcrypt-5.1.6-1.1mdv2007.0.src.rpm
c9e9b415eac3b864ffcece762c6aa6bb 2007.0/SRPMS/php-soap-5.1.6-1.2mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
8ddfb570e663d8b61cbfaf5bc8585d54 2007.0/x86_64/lib64php5_common5-5.1.6-1.9mdv2007.0.x86_64.rpm
d05d20ad5c5ddd84649aaed661b83c7a 2007.0/x86_64/php-cgi-5.1.6-1.9mdv2007.0.x86_64.rpm
9ba45cce68ffa043cf1fb23fe765e104 2007.0/x86_64/php-cli-5.1.6-1.9mdv2007.0.x86_64.rpm
26ead0e8cd3bab9ba64cc39f596d6533 2007.0/x86_64/php-devel-5.1.6-1.9mdv2007.0.x86_64.rpm
65673d78e3e1af683d64e30ba832be63 2007.0/x86_64/php-fcgi-5.1.6-1.9mdv2007.0.x86_64.rpm
0d478806da998759a96cdbf8694c0324 2007.0/x86_64/php-gd-5.1.6-1.3mdv2007.0.x86_64.rpm
99ec9336533a6ff74b93841497a73fe1 2007.0/x86_64/php-mcrypt-5.1.6-1.1mdv2007.0.x86_64.rpm
1b5bdc02b561134835c729fb404b0931 2007.0/x86_64/php-soap-5.1.6-1.2mdv2007.0.x86_64.rpm
06fef845a7f0eb15fbda8e01d2449759 2007.0/SRPMS/php-5.1.6-1.9mdv2007.0.src.rpm
1c4c5379d367dd0ba8c002d2a60eb8b1 2007.0/SRPMS/php-gd-5.1.6-1.3mdv2007.0.src.rpm
4b4382448f9be55ea66f8b910a12a97c 2007.0/SRPMS/php-mcrypt-5.1.6-1.1mdv2007.0.src.rpm
c9e9b415eac3b864ffcece762c6aa6bb 2007.0/SRPMS/php-soap-5.1.6-1.2mdv2007.0.src.rpm
Mandriva Linux 2007.1:
cfb5ebca225920865fd41b8d7379ec04 2007.1/i586/libphp5_common5-5.2.1-4.3mdv2007.1.i586.rpm
fd99e8fd1eba60464844111ba0bf658f 2007.1/i586/php-cgi-5.2.1-4.3mdv2007.1.i586.rpm
d2d5ef2a6eb326c85e5e4e66d5488032 2007.1/i586/php-cli-5.2.1-4.3mdv2007.1.i586.rpm
f8ff08caf4bf9d4b06c84dabf426ad4f 2007.1/i586/php-devel-5.2.1-4.3mdv2007.1.i586.rpm
0e362fc96f32b9046df73d01938f4a4f 2007.1/i586/php-fcgi-5.2.1-4.3mdv2007.1.i586.rpm
3796283e1a18abd35c66e9fdb7cecf84 2007.1/i586/php-gd-5.2.1-1.2mdv2007.1.i586.rpm
8303fdaff4f40f7025e84b9571db7557 2007.1/i586/php-mcrypt-5.2.1-1.1mdv2007.1.i586.rpm
765b7cff3e34bf6be0d31d5e11c6d21f 2007.1/i586/php-openssl-5.2.1-4.3mdv2007.1.i586.rpm
8ed091e407210049489fb70ba4f18e3f 2007.1/i586/php-soap-5.2.1-1.2mdv2007.1.i586.rpm
649f2efadad45640ca14f5ab644de67f 2007.1/i586/php-zlib-5.2.1-4.3mdv2007.1.i586.rpm
8779e5a26aecb35eaf93a5c54f35a798 2007.1/SRPMS/php-5.2.1-4.3mdv2007.1.src.rpm
d16710089832ae31873c0db7e6df87fd 2007.1/SRPMS/php-gd-5.2.1-1.2mdv2007.1.src.rpm
ec8b2d536f13c35dd2c2f1cca92c5694 2007.1/SRPMS/php-mcrypt-5.2.1-1.1mdv2007.1.src.rpm
90f9821184ef2fc8cca2a35e54080f44 2007.1/SRPMS/php-soap-5.2.1-1.2mdv2007.1.src.rpm
Mandriva Linux 2007.1/X86_64:
4af5b6e98feeeb88b8993768c15497ce 2007.1/x86_64/lib64php5_common5-5.2.1-4.3mdv2007.1.x86_64.rpm
f5e5fbb413e349ff9ae9e8e82a59dd92 2007.1/x86_64/php-cgi-5.2.1-4.3mdv2007.1.x86_64.rpm
c93c070b38a3c2602dbfea38e648fea1 2007.1/x86_64/php-cli-5.2.1-4.3mdv2007.1.x86_64.rpm
5d7fa073092e6599eddaaffab5b4df4f 2007.1/x86_64/php-devel-5.2.1-4.3mdv2007.1.x86_64.rpm
0d593dad6f79e0331d1a9c7544d6fe42 2007.1/x86_64/php-fcgi-5.2.1-4.3mdv2007.1.x86_64.rpm
8652914b9aa256724004e12621111ce3 2007.1/x86_64/php-gd-5.2.1-1.2mdv2007.1.x86_64.rpm
cc2993f0faf2d76eb317162162237049 2007.1/x86_64/php-mcrypt-5.2.1-1.1mdv2007.1.x86_64.rpm
2becb2e136e605d4b6fcbb80b8b96fdc 2007.1/x86_64/php-openssl-5.2.1-4.3mdv2007.1.x86_64.rpm
241a453a1007cc84f0f789b2a11bf96f 2007.1/x86_64/php-soap-5.2.1-1.2mdv2007.1.x86_64.rpm
58a30a4284944ed364d488338c6d4605 2007.1/x86_64/php-zlib-5.2.1-4.3mdv2007.1.x86_64.rpm
8779e5a26aecb35eaf93a5c54f35a798 2007.1/SRPMS/php-5.2.1-4.3mdv2007.1.src.rpm
d16710089832ae31873c0db7e6df87fd 2007.1/SRPMS/php-gd-5.2.1-1.2mdv2007.1.src.rpm
ec8b2d536f13c35dd2c2f1cca92c5694 2007.1/SRPMS/php-mcrypt-5.2.1-1.1mdv2007.1.src.rpm
90f9821184ef2fc8cca2a35e54080f44 2007.1/SRPMS/php-soap-5.2.1-1.2mdv2007.1.src.rpm
Corporate 3.0:
247e24717edaad099d4dfac36d06da11 corporate/3.0/i586/libphp_common432-4.3.4-4.27.C30mdk.i586.rpm
a2fe1080b8981493b83f6bb6c08a6f83 corporate/3.0/i586/php-cgi-4.3.4-4.27.C30mdk.i586.rpm
0468aa254c2495b128f4ea776b7100f7 corporate/3.0/i586/php-cli-4.3.4-4.27.C30mdk.i586.rpm
230476bcb71774884ec17ecbef336e5c corporate/3.0/i586/php-gd-4.3.4-1.7.C30mdk.i586.rpm
3cac8eecfdee304b0889fbe99958a6ca corporate/3.0/i586/php432-devel-4.3.4-4.27.C30mdk.i586.rpm
74c8bcac18b502174d270a0e2529d8e8 corporate/3.0/SRPMS/php-4.3.4-4.27.C30mdk.src.rpm
7db08e02ff0b4d59c58bbef5ff25a89b corporate/3.0/SRPMS/php-gd-4.3.4-1.7.C30mdk.src.rpm
Corporate 3.0/X86_64:
54b38db5000d71f5f4cfe0d55ea8839d corporate/3.0/x86_64/lib64php_common432-4.3.4-4.27.C30mdk.x86_64.rpm
e06d422dedbd7ff39eb86c8afdf23f8c corporate/3.0/x86_64/php-cgi-4.3.4-4.27.C30mdk.x86_64.rpm
66bea84020ec6231dbc345215b6398d4 corporate/3.0/x86_64/php-cli-4.3.4-4.27.C30mdk.x86_64.rpm
6e47af7339e7c939133d3bbab0b54c60 corporate/3.0/x86_64/php-gd-4.3.4-1.7.C30mdk.x86_64.rpm
9aa27728797f8a8b7fe6932237779dc1 corporate/3.0/x86_64/php432-devel-4.3.4-4.27.C30mdk.x86_64.rpm
74c8bcac18b502174d270a0e2529d8e8 corporate/3.0/SRPMS/php-4.3.4-4.27.C30mdk.src.rpm
7db08e02ff0b4d59c58bbef5ff25a89b corporate/3.0/SRPMS/php-gd-4.3.4-1.7.C30mdk.src.rpm
Corporate 4.0:
6660cfe8b3e883412a9d138cb4776a17 corporate/4.0/i586/libphp4_common4-4.4.4-1.7.20060mlcs4.i586.rpm
0a43b956bf221f3dc6b534aed4c2c332 corporate/4.0/i586/libphp5_common5-5.1.6-1.8.20060mlcs4.i586.rpm
d01223da70e8e3c6c17b0bd065cf4747 corporate/4.0/i586/php-cgi-5.1.6-1.8.20060mlcs4.i586.rpm
9cdf4d6ba4446811b0118126b31dd80b corporate/4.0/i586/php-cli-5.1.6-1.8.20060mlcs4.i586.rpm
6f486a6a19edef73ac2bc6aba2cf342a corporate/4.0/i586/php-devel-5.1.6-1.8.20060mlcs4.i586.rpm
a126823de602fb9aecae42f052ab2827 corporate/4.0/i586/php-fcgi-5.1.6-1.8.20060mlcs4.i586.rpm
9c198b7e8a34c3e4d03f18174b2b1a84 corporate/4.0/i586/php-gd-5.1.6-1.3.20060mlcs4.i586.rpm
b58d0518a5a44bdb26006df7b3d0b9f4 corporate/4.0/i586/php-mcrypt-5.1.6-1.1.20060mlcs4.i586.rpm
c306da649d383d2ef0d4e568e8f77bd2 corporate/4.0/i586/php-soap-5.1.6-1.2.20060mlcs4.i586.rpm
6fbcf94c677317eaa73f2972afbece1c corporate/4.0/i586/php-zip-1.8.10-0.1.20060mlcs4.i586.rpm
473813677bb2f261182b53f6175908b8 corporate/4.0/i586/php4-cgi-4.4.4-1.7.20060mlcs4.i586.rpm
5c53c5fd3860246341522a47712b7d18 corporate/4.0/i586/php4-cli-4.4.4-1.7.20060mlcs4.i586.rpm
079851b5a916b27cb16aa4bde9bcd86e corporate/4.0/i586/php4-devel-4.4.4-1.7.20060mlcs4.i586.rpm
cf0a080ecd0acb5e01f7e2e41ed3c76d corporate/4.0/i586/php4-gd-4.4.4-1.2.20060mlcs4.i586.rpm
c2333bbae7d3a20b90a2e174f2caf5da corporate/4.0/i586/php4-mcrypt-4.4.4-1.1.20060mlcs4.i586.rpm
b406cd54519867c9611c6c6700827457 corporate/4.0/SRPMS/php-5.1.6-1.8.20060mlcs4.src.rpm
491027bf3182f1f56e93e4d3a053d9e0 corporate/4.0/SRPMS/php-gd-5.1.6-1.3.20060mlcs4.src.rpm
dd89eef4f40af9dff068c28bd56b4d5b corporate/4.0/SRPMS/php-mcrypt-5.1.6-1.1.20060mlcs4.src.rpm
d7107b5be0e7768abad9c15cc8584ded corporate/4.0/SRPMS/php-soap-5.1.6-1.2.20060mlcs4.src.rpm
f39e559d753bc59816d4106cd095d0db corporate/4.0/SRPMS/php-zip-1.8.10-0.1.20060mlcs4.src.rpm
1f1fd034cfd3d3f911315a34326d553e corporate/4.0/SRPMS/php4-4.4.4-1.7.20060mlcs4.src.rpm
00447503df74be2f96f4ec4f93de6694 corporate/4.0/SRPMS/php4-gd-4.4.4-1.2.20060mlcs4.src.rpm
c005bcfb3c95e618ba5a4c928d5b75c7 corporate/4.0/SRPMS/php4-mcrypt-4.4.4-1.1.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
d04a06f2a1d4c8d36b1ce3de6448577b corporate/4.0/x86_64/lib64php4_common4-4.4.4-1.7.20060mlcs4.x86_64.rpm
b22d1122c842de135ddf34d331641da8 corporate/4.0/x86_64/lib64php5_common5-5.1.6-1.8.20060mlcs4.x86_64.rpm
9866242fb135cca7cf3e35e97f5178af corporate/4.0/x86_64/php-cgi-5.1.6-1.8.20060mlcs4.x86_64.rpm
c68e05947bec3bb82e9d1d5c572f96d5 corporate/4.0/x86_64/php-cli-5.1.6-1.8.20060mlcs4.x86_64.rpm
cf53b9aaef91d88655f9d74e3ff2aacb corporate/4.0/x86_64/php-devel-5.1.6-1.8.20060mlcs4.x86_64.rpm
f8c251520d975a4010def1750fd8346d corporate/4.0/x86_64/php-fcgi-5.1.6-1.8.20060mlcs4.x86_64.rpm
5b34f8737e26d00f33c0328d763ab213 corporate/4.0/x86_64/php-gd-5.1.6-1.3.20060mlcs4.x86_64.rpm
758cf65ca6d0a4abebb902e0cba8a340 corporate/4.0/x86_64/php-mcrypt-5.1.6-1.1.20060mlcs4.x86_64.rpm
13bee1adbfe5e67c01ca731ea81dbdd9 corporate/4.0/x86_64/php-soap-5.1.6-1.2.20060mlcs4.x86_64.rpm
4c0b39d8927c6cb19e32befb0539680e corporate/4.0/x86_64/php-zip-1.8.10-0.1.20060mlcs4.x86_64.rpm
5ada3b423910e48a26c77a8cf95cc274 corporate/4.0/x86_64/php4-cgi-4.4.4-1.7.20060mlcs4.x86_64.rpm
84fae5bb1c27d7c4a6dcb7c29966e2ce corporate/4.0/x86_64/php4-cli-4.4.4-1.7.20060mlcs4.x86_64.rpm
ccc04f5e1301a856a4d8e24bd36342cb corporate/4.0/x86_64/php4-devel-4.4.4-1.7.20060mlcs4.x86_64.rpm
0eafa187fc47d54782cba69a73d500f8 corporate/4.0/x86_64/php4-gd-4.4.4-1.2.20060mlcs4.x86_64.rpm
17f6a6e9ff9cb623ba5538c46571fce5 corporate/4.0/x86_64/php4-mcrypt-4.4.4-1.1.20060mlcs4.x86_64.rpm
b406cd54519867c9611c6c6700827457 corporate/4.0/SRPMS/php-5.1.6-1.8.20060mlcs4.src.rpm
491027bf3182f1f56e93e4d3a053d9e0 corporate/4.0/SRPMS/php-gd-5.1.6-1.3.20060mlcs4.src.rpm
dd89eef4f40af9dff068c28bd56b4d5b corporate/4.0/SRPMS/php-mcrypt-5.1.6-1.1.20060mlcs4.src.rpm
d7107b5be0e7768abad9c15cc8584ded corporate/4.0/SRPMS/php-soap-5.1.6-1.2.20060mlcs4.src.rpm
f39e559d753bc59816d4106cd095d0db corporate/4.0/SRPMS/php-zip-1.8.10-0.1.20060mlcs4.src.rpm
1f1fd034cfd3d3f911315a34326d553e corporate/4.0/SRPMS/php4-4.4.4-1.7.20060mlcs4.src.rpm
00447503df74be2f96f4ec4f93de6694 corporate/4.0/SRPMS/php4-gd-4.4.4-1.2.20060mlcs4.src.rpm
c005bcfb3c95e618ba5a4c928d5b75c7 corporate/4.0/SRPMS/php4-mcrypt-4.4.4-1.1.20060mlcs4.src.rpm
Multi Network Firewall 2.0:
4a0e9e73f51d6118c3580b9f556c0a2d mnf/2.0/i586/libphp_common432-4.3.4-4.27.C30mdk.i586.rpm
f4698dd4eb9c4c9e12528c70cf458e7f mnf/2.0/i586/php-cgi-4.3.4-4.27.C30mdk.i586.rpm
91e6914a490349580511f216a8220c86 mnf/2.0/i586/php-cli-4.3.4-4.27.C30mdk.i586.rpm
b5655d8d54a14d9f5cdb56246ddad2e3 mnf/2.0/i586/php-gd-4.3.4-1.7.C30mdk.i586.rpm
752e636b31d84df4b9283fc56b60ef5b mnf/2.0/i586/php432-devel-4.3.4-4.27.C30mdk.i586.rpm
dba539a2cc542b14898bea508291fb93 mnf/2.0/SRPMS/php-4.3.4-4.27.C30mdk.src.rpm
86dacced331afeb19a375cdcd5ade744 mnf/2.0/SRPMS/php-gd-4.3.4-1.7.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
iD8DBQFG9CU6mqjQ0CJFipgRAs8RAKDsqCO/QPqLczFFlIVUz3pfMnFdUwCePmkK
vvRjTT2T2agDRpYmZWKYhFs=
=4TWc
-----END PGP SIGNATURE-----
