- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200710-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: High
     Title: PHP: Multiple vulnerabilities
      Date: October 07, 2007
      Bugs: #179158, #180556, #191034
        ID: 200710-02

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

PHP contains several vulnerabilities including buffer and integer
overflows which could lead to the remote execution of arbitrary code.

Background
==========

PHP is a widely-used general-purpose scripting language that is
especially suited for Web development and can be embedded into HTML.

Affected packages
=================

    -------------------------------------------------------------------
     Package       /       Vulnerable       /               Unaffected
    -------------------------------------------------------------------
  1  dev-lang/php     < 5.2.4_p20070914-r2       >= 5.2.4_p20070914-r2

Description
===========

Several vulnerabilities were found in PHP. Mattias Bengtsson and Philip
Olausson reported integer overflows in the gdImageCreate() and
gdImageCreateTrueColor() functions of the GD library which can cause
heap-based buffer overflows (CVE-2007-3996). Gerhard Wagner discovered
an integer overflow in the chunk_split() function that can lead to a
heap-based buffer overflow (CVE-2007-2872). Its incomplete fix caused
incorrect buffer size calculation due to precision loss, also resulting
in a possible heap-based buffer overflow (CVE-2007-4661 and
CVE-2007-4660). A buffer overflow in the sqlite_decode_binary() of the
SQLite extension found by Stefan Esser that was addressed in PHP 5.2.1
was not fixed correctly (CVE-2007-1887).

Stefan Esser discovered an error in the zend_alter_ini_entry() function
handling a memory_limit violation (CVE-2007-4659). Stefan Esser also
discovered a flaw when handling interruptions with userspace error
handlers that can be exploited to read arbitrary heap memory
(CVE-2007-1883). Disclosure of sensitive memory can also be triggered
due to insufficient boundary checks in the strspn() and strcspn()
functions, an issue discovered by Mattias Bengtsson and Philip Olausson
(CVE-2007-4657)

Stefan Esser reported incorrect validation in the FILTER_VALIDATE_EMAIL
filter of the Filter extension allowing arbitrary email header
injection (CVE-2007-1900). NOTE: This CVE was referenced, but not fixed
in GLSA 200705-19.

Stanislav Malyshev found an error with unknown impact in the
money_format() function when processing "%i" and "%n" tokens
(CVE-2007-4658). zatanzlatan reported a buffer overflow in the
php_openssl_make_REQ() function with unknown impact when providing a
manipulated SSL configuration file (CVE-2007-4662). Possible memory
corruption when trying to read EXIF data in exif_read_data() and
exif_thumbnail() occurred with unknown impact.

Several vulnerabilities that allow bypassing of open_basedir and other
restrictions were reported, including the glob() function
(CVE-2007-4663), the session_save_path(), ini_set(), and error_log()
functions which can allow local command execution (CVE-2007-3378),
involving the readfile() function (CVE-2007-3007), via the Session
extension (CVE-2007-4652), via the MySQL extension (CVE-2007-3997) and
in the dl() function which allows loading extensions outside of the
specified directory (CVE-2007-4825).

Multiple Denial of Service vulnerabilities were discovered, including a
long "library" parameter in the dl() function (CVE-2007-4887), in
several iconv and xmlrpc functions (CVE-2007-4840 and CVE-2007-4783),
in the setlocale() function (CVE-2007-4784), in the glob() and
fnmatch() function (CVE-2007-4782 and CVE-2007-3806), a floating point
exception in the wordwrap() function (CVE-2007-3998), a stack
exhaustion via deeply nested arrays (CVE-2007-4670), an infinite loop
caused by a specially crafted PNG image in the png_read_info() function
of libpng (CVE-2007-2756) and several issues related to array
conversion.

Impact
======

Remote attackers might be able to exploit these issues in PHP
applications making use of the affected functions, potentially
resulting in the execution of arbitrary code, Denial of Service,
execution of scripted contents in the context of the affected site,
security bypass or information leak.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All PHP users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-lang/php-5.2.4_p20070914-r2"

References
==========

  [ 1 ] CVE-2007-1883
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1883
  [ 2 ] CVE-2007-1887
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1887
  [ 3 ] CVE-2007-1900
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1900
  [ 4 ] CVE-2007-2756
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2756
  [ 5 ] CVE-2007-2872
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2872
  [ 6 ] CVE-2007-3007
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3007
  [ 7 ] CVE-2007-3378
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3378
  [ 8 ] CVE-2007-3806
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3806
  [ 9 ] CVE-2007-3996
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3996
  [ 10 ] CVE-2007-3997
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3997
  [ 11 ] CVE-2007-3998
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3998
  [ 12 ] CVE-2007-4652
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4652
  [ 13 ] CVE-2007-4657
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4657
  [ 14 ] CVE-2007-4658
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4658
  [ 15 ] CVE-2007-4659
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4659
  [ 16 ] CVE-2007-4660
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4660
  [ 17 ] CVE-2007-4661
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4661
  [ 18 ] CVE-2007-4662
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4662
  [ 19 ] CVE-2007-4663
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4663
  [ 20 ] CVE-2007-4670
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4670
  [ 21 ] CVE-2007-4727
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4727
  [ 22 ] CVE-2007-4782
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4782
  [ 23 ] CVE-2007-4783
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4783
  [ 24 ] CVE-2007-4784
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4784
  [ 25 ] CVE-2007-4825
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4825
  [ 26 ] CVE-2007-4840
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4840
  [ 27 ] CVE-2007-4887
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4887
  [ 28 ] GLSA 200705-19
         http://www.gentoo.org/security/en/glsa/glsa-200705-19.xml

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200710-02.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2007 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5