-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2006:162
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : php
 Date    : September 7, 2006
 Affected: 2006.0, Corporate 3.0, Multi Network Firewall 2.0
 _______________________________________________________________________
 
 Problem Description:
 
 The (1) file_exists and (2) imap_reopen functions in PHP before 5.1.5
 do not check for the safe_mode and open_basedir settings, which allows
 local users to bypass the settings (CVE-2006-4481).
 
 Buffer overflow in the LWZReadByte function in ext/gd/libgd/gd_gif_in.c
 in the GD extension in PHP before 5.1.5 allows remote attackers to have
 an unknown impact via a GIF file with input_code_size greater than
 MAX_LWZ_BITS, which triggers an overflow when initializing the table
 array (CVE-2006-4484).
 
 The stripos function in PHP before 5.1.5 has unknown impact and attack 
 vectors related to an out-of-bounds read (CVE-2006-4485).
 
 CVE-2006-4485 does not affect the Corporate3 or MNF2 versions of PHP.
 
 Updated packages have been patched to correct these issues.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4481
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4484
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4485
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2006.0:
 146279492bdd9a03694778e265582d65  2006.0/RPMS/libphp5_common5-5.0.4-9.14.20060mdk.i586.rpm
 ca99a7740c1b47df847a56cbb25a8e80  2006.0/RPMS/php-cgi-5.0.4-9.14.20060mdk.i586.rpm
 665f72c14d5c2d485047c8c288946227  2006.0/RPMS/php-cli-5.0.4-9.14.20060mdk.i586.rpm
 ddb6f8354c06c2f7bd78823dc846b2b5  2006.0/RPMS/php-devel-5.0.4-9.14.20060mdk.i586.rpm
 a8ba6ed38bb91aa170882a2c0ad32e32  2006.0/RPMS/php-fcgi-5.0.4-9.14.20060mdk.i586.rpm
 ddc3fc12907892012c0db9df119edaab  2006.0/RPMS/php-imap-5.0.4-2.4.20060mdk.i586.rpm
 7231862a27ba9135e9cfcce3c455af3a  2006.0/SRPMS/php-5.0.4-9.14.20060mdk.src.rpm
 69d5c165b33b00454cc56b27bb21eba7  2006.0/SRPMS/php-imap-5.0.4-2.4.20060mdk.src.rpm

 Mandriva Linux 2006.0/X86_64:
 4ba33ec1fd91fdad05aaffb2d8dc766a  x86_64/2006.0/RPMS/lib64php5_common5-5.0.4-9.14.20060mdk.x86_64.rpm
 023e44a6bc50c5edaa3abfe85a888ec3  x86_64/2006.0/RPMS/php-cgi-5.0.4-9.14.20060mdk.x86_64.rpm
 29e82f10dba8da27a73e57df3ffc198b  x86_64/2006.0/RPMS/php-cli-5.0.4-9.14.20060mdk.x86_64.rpm
 69fd9d2282d1bc50c19078f8537e4084  x86_64/2006.0/RPMS/php-devel-5.0.4-9.14.20060mdk.x86_64.rpm
 a849151feb32d3bcca9f5d175289fce5  x86_64/2006.0/RPMS/php-fcgi-5.0.4-9.14.20060mdk.x86_64.rpm
 1551e3c19dde54eaa19dabe5fe8a31db  x86_64/2006.0/RPMS/php-imap-5.0.4-2.4.20060mdk.x86_64.rpm
 7231862a27ba9135e9cfcce3c455af3a  x86_64/2006.0/SRPMS/php-5.0.4-9.14.20060mdk.src.rpm
 69d5c165b33b00454cc56b27bb21eba7  x86_64/2006.0/SRPMS/php-imap-5.0.4-2.4.20060mdk.src.rpm

 Corporate 3.0:
 3eb436590e289bc53b5bf6560ba04b02  corporate/3.0/RPMS/libphp_common432-4.3.4-4.20.C30mdk.i586.rpm
 25e55ccb44fe52f3a2dbbded0463c344  corporate/3.0/RPMS/php432-devel-4.3.4-4.20.C30mdk.i586.rpm
 b970a8c32bc44c3736173d90dc251141  corporate/3.0/RPMS/php-cgi-4.3.4-4.20.C30mdk.i586.rpm
 90098a78f8376e8abc5cad6d6eab75f9  corporate/3.0/RPMS/php-cli-4.3.4-4.20.C30mdk.i586.rpm
 65ec1dc0a8da743bbc8c31b02b2e0463  corporate/3.0/RPMS/php-gd-4.3.4-1.4.C30mdk.i586.rpm
 f301535d5f0f4eab5b0d6a1d9b231ef8  corporate/3.0/RPMS/php-imap-4.3.4-1.4.C30mdk.i586.rpm
 e7eb6f56b39b5c72b3a2dbb602ab8d46  corporate/3.0/SRPMS/php-4.3.4-4.20.C30mdk.src.rpm
 55da5f48aa9e2851b88377d436fc154b  corporate/3.0/SRPMS/php-gd-4.3.4-1.4.C30mdk.src.rpm
 3133219ccf7cd83aec8f03823b6bcf48  corporate/3.0/SRPMS/php-imap-4.3.4-1.4.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 c5213371e2b3ff49c18bcb7eea366b86  x86_64/corporate/3.0/RPMS/lib64php_common432-4.3.4-4.20.C30mdk.x86_64.rpm
 48206012e77a6949d36188f3b2743afc  x86_64/corporate/3.0/RPMS/php432-devel-4.3.4-4.20.C30mdk.x86_64.rpm
 e37a90b7ba3b52fce6bbecd6ec8960bf  x86_64/corporate/3.0/RPMS/php-cgi-4.3.4-4.20.C30mdk.x86_64.rpm
 24ce234e4d366125e4a13ca5ac2d0bf6  x86_64/corporate/3.0/RPMS/php-cli-4.3.4-4.20.C30mdk.x86_64.rpm
 60dd687ca2f9fc7b1aa8717533d1ed81  x86_64/corporate/3.0/RPMS/php-gd-4.3.4-1.4.C30mdk.x86_64.rpm
 86ff3c6e121b52fd6a092c7f8e35885c  x86_64/corporate/3.0/RPMS/php-imap-4.3.4-1.4.C30mdk.x86_64.rpm
 e7eb6f56b39b5c72b3a2dbb602ab8d46  x86_64/corporate/3.0/SRPMS/php-4.3.4-4.20.C30mdk.src.rpm
 55da5f48aa9e2851b88377d436fc154b  x86_64/corporate/3.0/SRPMS/php-gd-4.3.4-1.4.C30mdk.src.rpm
 3133219ccf7cd83aec8f03823b6bcf48  x86_64/corporate/3.0/SRPMS/php-imap-4.3.4-1.4.C30mdk.src.rpm

 Multi Network Firewall 2.0:
 90ed06dbf0316651afc4d8990477ca7d  mnf/2.0/RPMS/libphp_common432-4.3.4-4.20.M20mdk.i586.rpm
 bbf7116a28e92bd9c6ce531e8014cc22  mnf/2.0/RPMS/php432-devel-4.3.4-4.20.M20mdk.i586.rpm
 0c5f0a2f78cdb87ddd4a2a316d107e4c  mnf/2.0/RPMS/php-cgi-4.3.4-4.20.M20mdk.i586.rpm
 27885acc0df6e7fa21ee1d165df8f426  mnf/2.0/RPMS/php-cli-4.3.4-4.20.M20mdk.i586.rpm
 14c40d13e47645ceaddb28508008fd8f  mnf/2.0/RPMS/php-gd-4.3.4-1.4.M20mdk.i586.rpm
 bfdf39861fc0614d9a81889f6c0dbac6  mnf/2.0/SRPMS/php-4.3.4-4.20.M20mdk.src.rpm
 1c40bfd8df9786d467993f0eabc9eff9  mnf/2.0/SRPMS/php-gd-4.3.4-1.4.M20mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFFAFKJmqjQ0CJFipgRAlCxAKCTO1wmjhvmHOxneb2oh/V31G1BngCg9eRf
4PNgocaX6b6UlFBbSMDIl24=
=sS0Z
-----END PGP SIGNATURE-----