[Security Announce] [ MDKSA-2006:180 ] - Updated php packages fix integer overflow vulnerability

Posted by Bob on: 10/05/2006 11:40 PM [ Print | 0 comment(s) ]

The Mandriva Security Team published a new security update for Mandriva Linux. Here the announcement:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2006:180
http://www.mandriva.com/security/
_______________________________________________________________________

Package : php
Date : October 5, 2006
Affected: 2006.0, 2007.0
_______________________________________________________________________

Problem Description:

An integer overflow was discovered in the PHP memory handling routines.
If a script can cause memory allocation based on untrusted user data, a
remote attacker sending a carefully crafted request could execute
arbitrary code as the 'apache' user.

Updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4812
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2006.0:
6ac30c43d712db9447f2be74ddfaa40a 2006.0/i586/libphp5_common5-5.0.4-9.15.20060mdk.i586.rpm
df476188754c1df5da3a86b91f8c1987 2006.0/i586/php-cgi-5.0.4-9.15.20060mdk.i586.rpm
6a2593131e09a34423b3cbfa74edab9b 2006.0/i586/php-cli-5.0.4-9.15.20060mdk.i586.rpm
20efe33389dbb5304d732d09dce04463 2006.0/i586/php-devel-5.0.4-9.15.20060mdk.i586.rpm
db440436a40b6f253d751714506a3e0d 2006.0/i586/php-fcgi-5.0.4-9.15.20060mdk.i586.rpm
f1e6029968873eeaf58659e6f8f56f0f 2006.0/SRPMS/php-5.0.4-9.15.20060mdk.src.rpm

Mandriva Linux 2006.0/X86_64:
82c8b4eb0e5bb855227846f6d3398bf9 2006.0/x86_64/lib64php5_common5-5.0.4-9.15.20060mdk.x86_64.rpm
bbd0ab99535516869b6e1eafdc4e13dd 2006.0/x86_64/php-cgi-5.0.4-9.15.20060mdk.x86_64.rpm
a27aaaf58e981e0d3cc118dec0c51f67 2006.0/x86_64/php-cli-5.0.4-9.15.20060mdk.x86_64.rpm
14388814a935ece2ca160d8423652dca 2006.0/x86_64/php-devel-5.0.4-9.15.20060mdk.x86_64.rpm
73de1863d4d02010b2061414d980e360 2006.0/x86_64/php-fcgi-5.0.4-9.15.20060mdk.x86_64.rpm
f1e6029968873eeaf58659e6f8f56f0f 2006.0/SRPMS/php-5.0.4-9.15.20060mdk.src.rpm

Mandriva Linux 2007.0:
af43f53c775a56613baa08becc0ffd8e 2007.0/i586/libphp5_common5-5.1.6-1.1mdv2007.0.i586.rpm
4a7616b81b7b44690d743fa731e10c77 2007.0/i586/php-cgi-5.1.6-1.1mdv2007.0.i586.rpm
a37c23311a003f8736ec0a3b3b29fa63 2007.0/i586/php-cli-5.1.6-1.1mdv2007.0.i586.rpm
c6d085ba649258ae2ab6d092be64cdff 2007.0/i586/php-devel-5.1.6-1.1mdv2007.0.i586.rpm
8b2e2ab58f18a242ff3d2bc44859d144 2007.0/i586/php-fcgi-5.1.6-1.1mdv2007.0.i586.rpm
f43ef0b533e7844b8320bbb2862a7a3e 2007.0/SRPMS/php-5.1.6-1.1mdv2007.0.src.rpm

Mandriva Linux 2007.0/X86_64:
477c4dc57c253f33464a562ece238537 2007.0/x86_64/lib64php5_common5-5.1.6-1.1mdv2007.0.x86_64.rpm
0e437323d4dc15f9445de8991a9b69c9 2007.0/x86_64/php-cgi-5.1.6-1.1mdv2007.0.x86_64.rpm
75ffda1f5d0946401257f3f1f59c5c60 2007.0/x86_64/php-cli-5.1.6-1.1mdv2007.0.x86_64.rpm
30094b00441d0af123bc6170f7945ea4 2007.0/x86_64/php-devel-5.1.6-1.1mdv2007.0.x86_64.rpm
ed779aabad5448745c9ef23f0eab9d63 2007.0/x86_64/php-fcgi-5.1.6-1.1mdv2007.0.x86_64.rpm
f43ef0b533e7844b8320bbb2862a7a3e 2007.0/SRPMS/php-5.1.6-1.1mdv2007.0.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
lt;security*mandriva.comgt;
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFFJVpLmqjQ0CJFipgRAjlfAJ9OV39Yb97us6c9vKFOiZwwaE3ZWwCffp49
1snZ5eKM19U4qu+Sb3Am4rs=
=6GRb
-----END PGP SIGNATURE-----