[Security Announce] [ MDKSA-2007:110 ] - Updated php-pear packages fix directory traversal vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2007:110
http://www.mandriva.com/security/
_______________________________________________________________________

Package : php-pear
Date : June 4, 2007
Affected: 2007.0, 2007.1, Corporate 3.0, Corporate 4.0
_______________________________________________________________________

Problem Description:

A security hole was discovered in all versions of the PEAR Installer
(http://pear.php.net/PEAR). The security hole is the most serious
hole found to date in the PEAR Installer, and would allow a malicious
package to install files anywhere in the filesystem.

The vulnerability only affects users who are installing an
intentionally created package with a malicious intent. Because the
package is easily traced to its source, this is most likely to happen
if a hacker were to compromise a PEAR channel server and alter a
package to install a backdoor. In other words, it must be combined
with other exploits to be a problem.

Updated packages have been patched to prevent this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2519
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2007.0:
64c39ee86584450d0107064891db66a4 2007.0/i586/php-pear-5.1.6-1.1mdv2007.0.noarch.rpm
ad180de3fabf01f13300b60d27e69b8a 2007.0/SRPMS/php-pear-5.1.6-1.1mdv2007.0.src.rpm

Mandriva Linux 2007.0/X86_64:
e9cd136d7adb4cd156e8609bee74142c 2007.0/x86_64/php-pear-5.1.6-1.1mdv2007.0.noarch.rpm
ad180de3fabf01f13300b60d27e69b8a 2007.0/SRPMS/php-pear-5.1.6-1.1mdv2007.0.src.rpm

Mandriva Linux 2007.1:
dc3c4b6fde1e247c7b7889720b9a1545 2007.1/i586/php-pear-5.2.1-2.1mdv2007.1.noarch.rpm
c6314a0505a7acc4638bc6d001de3dce 2007.1/SRPMS/php-pear-5.2.1-2.1mdv2007.1.src.rpm

Mandriva Linux 2007.1/X86_64:
d54d49680305ebe3e66074cb9ef9d837 2007.1/x86_64/php-pear-5.2.1-2.1mdv2007.1.noarch.rpm
c6314a0505a7acc4638bc6d001de3dce 2007.1/SRPMS/php-pear-5.2.1-2.1mdv2007.1.src.rpm

Corporate 3.0:
9d53ac39e37aeefb528ae3fd0992bdc3 corporate/3.0/i586/php-pear-4.3.4-3.3.C30mdk.noarch.rpm
2af0291e0a641824b71b209f177ee498 corporate/3.0/SRPMS/php-pear-4.3.4-3.3.C30mdk.src.rpm

Corporate 3.0/X86_64:
d32d35a205af81a080cf9081f1d09853 corporate/3.0/x86_64/php-pear-4.3.4-3.3.C30mdk.noarch.rpm
2af0291e0a641824b71b209f177ee498 corporate/3.0/SRPMS/php-pear-4.3.4-3.3.C30mdk.src.rpm

Corporate 4.0:
7adcd35487d7069c97dd103a46328348 corporate/4.0/i586/php-pear-5.1.4-3.1.20060mlcs4.noarch.rpm
4a88c5020d4986d32fbd0fda00c6176c corporate/4.0/SRPMS/php-pear-5.1.4-3.1.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
efba2ee2dc33696c001dab09cfe6dd34 corporate/4.0/x86_64/php-pear-5.1.4-3.1.20060mlcs4.noarch.rpm
4a88c5020d4986d32fbd0fda00c6176c corporate/4.0/SRPMS/php-pear-5.1.4-3.1.20060mlcs4.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
lt;security*mandriva.comgt;
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFGZF3tmqjQ0CJFipgRAqHdAJ4/U5xXkgz1tBilWMJ33y6J4jbx4QCfY8nk
IEujjQWOE/jaPU3KqZQxiMA=
=VLsJ
-----END PGP SIGNATURE-----