-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDKSA-2007:089 http://www.mandriva.com/security/ _______________________________________________________________________ Package : php Date : April 18, 2007 Affected: 2007.0, Corporate 4.0 _______________________________________________________________________ Problem Description: A heap-based buffer overflow vulnerability was found in PHP's gd extension. A script that could be forced to process WBMP images from an untrusted source could result in arbitrary code execution (CVE-2007-1001). A DoS flaw was found in how PHP processed a deeply nested array. A remote attacker could cause the PHP intrerpreter to creash by submitting an input variable with a deeply nested array (CVE-2007-1285). A vulnerability in the way the mbstring extension set global variables was discovered where a script using the mb_parse_str() function to set global variables could be forced to to enable the register_globals configuration option, possibly resulting in global variable injection (CVE-2007-1583). A vulnerability in how PHP's mail() function processed header data was discovered. If a script sent mail using a subject header containing a string from an untrusted source, a remote attacker could send bulk email to unintended recipients (CVE-2007-1718). A buffer overflow in the sqlite_decode_function() in the bundled sqlite library could allow context-dependent attackers to execute arbitrary code (CVE-2007-1887). Updated packages have been patched to correct these issues. Also note that the default use of the Hardened PHP patch helped to protect against some of these issues prior to patching. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1001 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1285 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1583 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1718 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1887 _______________________________________________________________________ Updated Packages: Mandriva Linux 2007.0: 9cf466b76665bc033530c80f504eb54e 2007.0/i586/libphp5_common5-5.1.6-1.7mdv2007.0.i586.rpm a1d9ebfcc187c4494af7e1e39fdf0f47 2007.0/i586/php-cgi-5.1.6-1.7mdv2007.0.i586.rpm 55439de9b2c70cc97cee9b51fb5a89a9 2007.0/i586/php-cli-5.1.6-1.7mdv2007.0.i586.rpm 8c77d342600f50e6157a3df4f1f9b8f1 2007.0/i586/php-devel-5.1.6-1.7mdv2007.0.i586.rpm f3c5bc37d6a24279a5f63b9f18e913f9 2007.0/i586/php-fcgi-5.1.6-1.7mdv2007.0.i586.rpm ca1858b16d0a4d080e052bc182fc391f 2007.0/i586/php-gd-5.1.6-1.2mdv2007.0.i586.rpm ddb1de61592f7a7281e5e91449398305 2007.0/i586/php-mbstring-5.1.6-1.1mdv2007.0.i586.rpm 083edc863400b03a69056dca44ba3a2e 2007.0/i586/php-sqlite-5.1.6-1.1mdv2007.0.i586.rpm eb4be9590d4b82d63d3041b5963dd365 2007.0/SRPMS/php-5.1.6-1.7mdv2007.0.src.rpm c488b9c4f369ac8f7bb7b727938d75bc 2007.0/SRPMS/php-gd-5.1.6-1.2mdv2007.0.src.rpm 85269cbd42e2900ee754891e240120b3 2007.0/SRPMS/php-mbstring-5.1.6-1.1mdv2007.0.src.rpm 3672001f271ae73ac8024455a887ef6e 2007.0/SRPMS/php-sqlite-5.1.6-1.1mdv2007.0.src.rpm Mandriva Linux 2007.0/X86_64: 4da00df59f3a9fc8105c3b540cf4054a 2007.0/x86_64/lib64php5_common5-5.1.6-1.7mdv2007.0.x86_64.rpm 6eb974c7d025e406bd8ee1b72f5972fe 2007.0/x86_64/php-cgi-5.1.6-1.7mdv2007.0.x86_64.rpm e4922361429c9aab92a44496e04eb409 2007.0/x86_64/php-cli-5.1.6-1.7mdv2007.0.x86_64.rpm 17e01392077a6c435455d0b521e82d7a 2007.0/x86_64/php-devel-5.1.6-1.7mdv2007.0.x86_64.rpm f73924c3f06c16e1382be7d18e1d1494 2007.0/x86_64/php-fcgi-5.1.6-1.7mdv2007.0.x86_64.rpm 3a88b1be7ed446e0d5a09ae8f0d64cf4 2007.0/x86_64/php-gd-5.1.6-1.2mdv2007.0.x86_64.rpm d983f296eba0b5d1642c1a673bf6673c 2007.0/x86_64/php-mbstring-5.1.6-1.1mdv2007.0.x86_64.rpm 3f1e547ebc7cb5debd2c818ad3746404 2007.0/x86_64/php-sqlite-5.1.6-1.1mdv2007.0.x86_64.rpm eb4be9590d4b82d63d3041b5963dd365 2007.0/SRPMS/php-5.1.6-1.7mdv2007.0.src.rpm c488b9c4f369ac8f7bb7b727938d75bc 2007.0/SRPMS/php-gd-5.1.6-1.2mdv2007.0.src.rpm 85269cbd42e2900ee754891e240120b3 2007.0/SRPMS/php-mbstring-5.1.6-1.1mdv2007.0.src.rpm 3672001f271ae73ac8024455a887ef6e 2007.0/SRPMS/php-sqlite-5.1.6-1.1mdv2007.0.src.rpm Corporate 4.0: a15a2db081dbf8b39751a8831e24cfd8 corporate/4.0/i586/libphp5_common5-5.1.6-1.6.20060mlcs4.i586.rpm 00f3d7a49c95ad203105d69dbf60acd1 corporate/4.0/i586/php-cgi-5.1.6-1.6.20060mlcs4.i586.rpm 6579f0081fd03d78bcbbfcec165fa017 corporate/4.0/i586/php-cli-5.1.6-1.6.20060mlcs4.i586.rpm 2e54eaef6e350edb05e57291820b40ea corporate/4.0/i586/php-devel-5.1.6-1.6.20060mlcs4.i586.rpm a74807717c95d2aa153f65ca94522f99 corporate/4.0/i586/php-fcgi-5.1.6-1.6.20060mlcs4.i586.rpm e79a2f636d497934ddf8b507d4cb54cc corporate/4.0/i586/php-gd-5.1.6-1.2.20060mlcs4.i586.rpm 18c113b8fd4b1dd9d8d3c8638da5f25b corporate/4.0/i586/php-mbstring-5.1.6-1.1.20060mlcs4.i586.rpm 0464c30285a7d41d295efced9ea13475 corporate/4.0/i586/php-sqlite-5.1.6-1.1.20060mlcs4.i586.rpm 35972da2bd604325e2ce45fee5f2229f corporate/4.0/SRPMS/php-5.1.6-1.6.20060mlcs4.src.rpm e506bf4c83ce83e4957018d0eae9638d corporate/4.0/SRPMS/php-gd-5.1.6-1.2.20060mlcs4.src.rpm 724ff1f27ef0b5daac393c4ce1f1f238 corporate/4.0/SRPMS/php-mbstring-5.1.6-1.1.20060mlcs4.src.rpm 73e6b41861c52d73d1e744f4a726403b corporate/4.0/SRPMS/php-sqlite-5.1.6-1.1.20060mlcs4.src.rpm Corporate 4.0/X86_64: cf307c130586c41c75f59a44f9c85d9b corporate/4.0/x86_64/lib64php5_common5-5.1.6-1.6.20060mlcs4.x86_64.rpm cd0091895f438d0d5cf70653b547c9ff corporate/4.0/x86_64/php-cgi-5.1.6-1.6.20060mlcs4.x86_64.rpm b037c050f0143b6b28a6915f86a15780 corporate/4.0/x86_64/php-cli-5.1.6-1.6.20060mlcs4.x86_64.rpm 82f04ea296e82ca8e062f1f783dfa6ee corporate/4.0/x86_64/php-devel-5.1.6-1.6.20060mlcs4.x86_64.rpm 4a62890162c10d8757c6ce7398f33948 corporate/4.0/x86_64/php-fcgi-5.1.6-1.6.20060mlcs4.x86_64.rpm a1eda733d9134658499315de0ccc6d8a corporate/4.0/x86_64/php-gd-5.1.6-1.2.20060mlcs4.x86_64.rpm 280e7b19617244aecbe446f48f3b8c72 corporate/4.0/x86_64/php-mbstring-5.1.6-1.1.20060mlcs4.x86_64.rpm c94b1c4fe2fc5890443105b365b16d96 corporate/4.0/x86_64/php-sqlite-5.1.6-1.1.20060mlcs4.x86_64.rpm 35972da2bd604325e2ce45fee5f2229f corporate/4.0/SRPMS/php-5.1.6-1.6.20060mlcs4.src.rpm e506bf4c83ce83e4957018d0eae9638d corporate/4.0/SRPMS/php-gd-5.1.6-1.2.20060mlcs4.src.rpm 724ff1f27ef0b5daac393c4ce1f1f238 corporate/4.0/SRPMS/php-mbstring-5.1.6-1.1.20060mlcs4.src.rpm 73e6b41861c52d73d1e744f4a726403b corporate/4.0/SRPMS/php-sqlite-5.1.6-1.1.20060mlcs4.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) iD8DBQFGJthCmqjQ0CJFipgRAovVAKC70IrJBcN4C0S8Stwl7ZbJemOyaQCgguFK iM9nzjKqkDmAfVjb/BMoJ6w= =VHym -----END PGP SIGNATURE-----