- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200710-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: PHP: Multiple vulnerabilities Date: October 07, 2007 Bugs: #179158, #180556, #191034 ID: 200710-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== PHP contains several vulnerabilities including buffer and integer overflows which could lead to the remote execution of arbitrary code. Background ========== PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-lang/php < 5.2.4_p20070914-r2 >= 5.2.4_p20070914-r2 Description =========== Several vulnerabilities were found in PHP. Mattias Bengtsson and Philip Olausson reported integer overflows in the gdImageCreate() and gdImageCreateTrueColor() functions of the GD library which can cause heap-based buffer overflows (CVE-2007-3996). Gerhard Wagner discovered an integer overflow in the chunk_split() function that can lead to a heap-based buffer overflow (CVE-2007-2872). Its incomplete fix caused incorrect buffer size calculation due to precision loss, also resulting in a possible heap-based buffer overflow (CVE-2007-4661 and CVE-2007-4660). A buffer overflow in the sqlite_decode_binary() of the SQLite extension found by Stefan Esser that was addressed in PHP 5.2.1 was not fixed correctly (CVE-2007-1887). Stefan Esser discovered an error in the zend_alter_ini_entry() function handling a memory_limit violation (CVE-2007-4659). Stefan Esser also discovered a flaw when handling interruptions with userspace error handlers that can be exploited to read arbitrary heap memory (CVE-2007-1883). Disclosure of sensitive memory can also be triggered due to insufficient boundary checks in the strspn() and strcspn() functions, an issue discovered by Mattias Bengtsson and Philip Olausson (CVE-2007-4657) Stefan Esser reported incorrect validation in the FILTER_VALIDATE_EMAIL filter of the Filter extension allowing arbitrary email header injection (CVE-2007-1900). NOTE: This CVE was referenced, but not fixed in GLSA 200705-19. Stanislav Malyshev found an error with unknown impact in the money_format() function when processing "%i" and "%n" tokens (CVE-2007-4658). zatanzlatan reported a buffer overflow in the php_openssl_make_REQ() function with unknown impact when providing a manipulated SSL configuration file (CVE-2007-4662). Possible memory corruption when trying to read EXIF data in exif_read_data() and exif_thumbnail() occurred with unknown impact. Several vulnerabilities that allow bypassing of open_basedir and other restrictions were reported, including the glob() function (CVE-2007-4663), the session_save_path(), ini_set(), and error_log() functions which can allow local command execution (CVE-2007-3378), involving the readfile() function (CVE-2007-3007), via the Session extension (CVE-2007-4652), via the MySQL extension (CVE-2007-3997) and in the dl() function which allows loading extensions outside of the specified directory (CVE-2007-4825). Multiple Denial of Service vulnerabilities were discovered, including a long "library" parameter in the dl() function (CVE-2007-4887), in several iconv and xmlrpc functions (CVE-2007-4840 and CVE-2007-4783), in the setlocale() function (CVE-2007-4784), in the glob() and fnmatch() function (CVE-2007-4782 and CVE-2007-3806), a floating point exception in the wordwrap() function (CVE-2007-3998), a stack exhaustion via deeply nested arrays (CVE-2007-4670), an infinite loop caused by a specially crafted PNG image in the png_read_info() function of libpng (CVE-2007-2756) and several issues related to array conversion. Impact ====== Remote attackers might be able to exploit these issues in PHP applications making use of the affected functions, potentially resulting in the execution of arbitrary code, Denial of Service, execution of scripted contents in the context of the affected site, security bypass or information leak. Workaround ========== There is no known workaround at this time. Resolution ========== All PHP users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-lang/php-5.2.4_p20070914-r2" References ========== [ 1 ] CVE-2007-1883 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1883 [ 2 ] CVE-2007-1887 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1887 [ 3 ] CVE-2007-1900 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1900 [ 4 ] CVE-2007-2756 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2756 [ 5 ] CVE-2007-2872 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2872 [ 6 ] CVE-2007-3007 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3007 [ 7 ] CVE-2007-3378 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3378 [ 8 ] CVE-2007-3806 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3806 [ 9 ] CVE-2007-3996 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3996 [ 10 ] CVE-2007-3997 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3997 [ 11 ] CVE-2007-3998 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3998 [ 12 ] CVE-2007-4652 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4652 [ 13 ] CVE-2007-4657 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4657 [ 14 ] CVE-2007-4658 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4658 [ 15 ] CVE-2007-4659 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4659 [ 16 ] CVE-2007-4660 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4660 [ 17 ] CVE-2007-4661 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4661 [ 18 ] CVE-2007-4662 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4662 [ 19 ] CVE-2007-4663 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4663 [ 20 ] CVE-2007-4670 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4670 [ 21 ] CVE-2007-4727 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4727 [ 22 ] CVE-2007-4782 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4782 [ 23 ] CVE-2007-4783 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4783 [ 24 ] CVE-2007-4784 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4784 [ 25 ] CVE-2007-4825 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4825 [ 26 ] CVE-2007-4840 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4840 [ 27 ] CVE-2007-4887 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4887 [ 28 ] GLSA 200705-19 http://www.gentoo.org/security/en/glsa/glsa-200705-19.xml Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200710-02.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2007 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5