[UCI-Linux] [SECURITY] Fedora Core 4 Update: php-5.0.4-10.5

Mike Iglesias iglesias at draco.acs.uci.edu
Tue Nov 8 11:14:22 PST 2005


From: "Joseph Orton" <jorton at redhat.com>
To: fedora-announce-list at redhat.com
Date: Tue, 8 Nov 2005 13:10:46 -0500
Subject: [SECURITY] Fedora Core 4 Update: php-5.0.4-10.5

---------------------------------------------------------------------
Fedora Update Notification
FEDORA-2005-1062
2005-11-08
---------------------------------------------------------------------

Product     : Fedora Core 4
Name        : php
Version     : 5.0.4                      
Release     : 10.5                  
Summary     : The PHP HTML-embedded scripting language. (PHP: Hypertext
Preprocessor)
Description :
PHP is an HTML-embedded scripting language. PHP attempts to make it
easy for developers to write dynamically generated webpages. PHP also
offers built-in database integration for several commercial and
non-commercial database management systems, so writing a
database-enabled webpage with PHP is fairly simple. The most common
use of PHP coding is probably as a replacement for CGI scripts. The
mod_php module enables the Apache Web server to understand and process
the embedded PHP language in Web pages.

---------------------------------------------------------------------
Update Information:

This update includes several security fixes:

- fixes for prevent malicious requests from overwriting the
GLOBALS array (CVE-2005-3390)

- a fix to stop the parse_str() function from enabling the
register_globals setting (CVE-2005-3389)

- fixes for Cross-Site Scripting flaws in the phpinfo()
output (CVE-2005-3388)

- a fix for a denial of service (process crash) in EXIF
image parsing (CVE-2005-3353)

---------------------------------------------------------------------
* Fri Nov  4 2005 Joe Orton <jorton at redhat.com> 5.0.4-10.5
- add security fixes from upstream:
 * XSS issues in phpinfo() (CVE-2005-3388, #172212)
 * GLOBALS handling (CVE-2005-3390, #172207)
 * parse_str() enabling register_globals (CVE-2005-3389, #172209)
 * exif: infinite recursion on corrupt JPEG (CVE-2005-3353)
- add unserializer fix for x86_64 (upstream #34435)


---------------------------------------------------------------------
This update can be downloaded from:
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/4/

4335290d44b2e5a9e0bae18c6a083b60  SRPMS/php-5.0.4-10.5.src.rpm
33c196f4c005196c1d53764a2ee31ebb  ppc/php-5.0.4-10.5.ppc.rpm
129ad57e9524495748107e94ef3919c4  ppc/php-devel-5.0.4-10.5.ppc.rpm
67117718bca8eefd800dcb3bb4f1a78d  ppc/php-pear-5.0.4-10.5.ppc.rpm
76137ee5a1e37c435531a8152c0b3aa6  ppc/php-imap-5.0.4-10.5.ppc.rpm
1be58c15e916d164623bb43b8413e593  ppc/php-ldap-5.0.4-10.5.ppc.rpm
cf1362b1d3293ebaee2a9b5ac4e55af4  ppc/php-mysql-5.0.4-10.5.ppc.rpm
cfe10b007be2a3a53231648fc709955c  ppc/php-pgsql-5.0.4-10.5.ppc.rpm
26966ffcaa801ba3af557ca4d909fc6f  ppc/php-odbc-5.0.4-10.5.ppc.rpm
688a6289cd74bded8eec8f590e5aa0b2  ppc/php-soap-5.0.4-10.5.ppc.rpm
2cbdf7bf156df0b5cf828e101e73e1fb  ppc/php-snmp-5.0.4-10.5.ppc.rpm
b2234815d67f6454f01e6b4e2f7d08a3  ppc/php-xml-5.0.4-10.5.ppc.rpm
5396b3f2093ebe5c0d952496cc1e0f53  ppc/php-xmlrpc-5.0.4-10.5.ppc.rpm
dd37612bb7325f2bc8b434ace6a88274  ppc/php-mbstring-5.0.4-10.5.ppc.rpm
ccff0bf6b530520d58b82b08a8673494  ppc/php-ncurses-5.0.4-10.5.ppc.rpm
88f33ff60368e3d95345054d70e1836b  ppc/php-gd-5.0.4-10.5.ppc.rpm
8f108fc28164e457d61e68aab9fc6ac0  ppc/php-bcmath-5.0.4-10.5.ppc.rpm
8d1f816bfb1e25e51dfe934afce98458  ppc/php-dba-5.0.4-10.5.ppc.rpm
9f5d9c6cc90f0d714cb7e7c7213fc5cc  ppc/debug/php-debuginfo-5.0.4-10.5.ppc.rpm
de90066477ed98470724063ebee6cd6f  x86_64/php-5.0.4-10.5.x86_64.rpm
a3658629bc9aae101f728fa2e07c553a  x86_64/php-devel-5.0.4-10.5.x86_64.rpm
664a5735c6d892e1ca51f6cbb1fd3ba0  x86_64/php-pear-5.0.4-10.5.x86_64.rpm
89f640b39a2a18cbfcfec17ad4ab79c8  x86_64/php-imap-5.0.4-10.5.x86_64.rpm
e755c66fc8e01c680758803bc4c9077f  x86_64/php-ldap-5.0.4-10.5.x86_64.rpm
8a051d3c467c8bf12e2cb50908613427  x86_64/php-mysql-5.0.4-10.5.x86_64.rpm
2811e927599be9fb668efd5bd2bc52c9  x86_64/php-pgsql-5.0.4-10.5.x86_64.rpm
2525eff98d5aaf242650229feca4d028  x86_64/php-odbc-5.0.4-10.5.x86_64.rpm
2bf0b0f286cbe8b555e3dddce3be9e78  x86_64/php-soap-5.0.4-10.5.x86_64.rpm
5255c6d146a38eb23a0dde0d37c2a72f  x86_64/php-snmp-5.0.4-10.5.x86_64.rpm
1e1161abd9f04e8608cf0bdba7e72c02  x86_64/php-xml-5.0.4-10.5.x86_64.rpm
dbf2339e1a6db6b20f97f85e90f6522b  x86_64/php-xmlrpc-5.0.4-10.5.x86_64.rpm
f98c7ab4bcea1307974e2dde86561ef9  x86_64/php-mbstring-5.0.4-10.5.x86_64.rpm
0e96505932ca49e6c631cbb930cc7b30  x86_64/php-ncurses-5.0.4-10.5.x86_64.rpm
4406c22ac3ca985957b086e9abd06a42  x86_64/php-gd-5.0.4-10.5.x86_64.rpm
d72bf1a65686f6ae2ae7eee0758c484f  x86_64/php-bcmath-5.0.4-10.5.x86_64.rpm
38694809232db581f791be27b21b96a1  x86_64/php-dba-5.0.4-10.5.x86_64.rpm
d48c6f1dc89b916c845ba519bb5cfba7  x86_64/debug/php-debuginfo-5.0.4-10.5.x86_64.rpm
fb1436e7a723233406d6489cc7cd7d62  i386/php-5.0.4-10.5.i386.rpm
e2a4866c6f213990a0e4baa8b8b6a824  i386/php-devel-5.0.4-10.5.i386.rpm
6e6767c83168ec51ddfd7f21912e799c  i386/php-pear-5.0.4-10.5.i386.rpm
5957130394b19b2a94175e7f1021dea5  i386/php-imap-5.0.4-10.5.i386.rpm
4c46a432d194756358de7fb571fc7f88  i386/php-ldap-5.0.4-10.5.i386.rpm
9076a327b2d839519360c394237c63c6  i386/php-mysql-5.0.4-10.5.i386.rpm
120c0100bf15d0d4c05f26496a69ddf3  i386/php-pgsql-5.0.4-10.5.i386.rpm
748370888887fabe751b6b9aec05601b  i386/php-odbc-5.0.4-10.5.i386.rpm
5a50e3fd65d1f1be5c181dcb56b991a2  i386/php-soap-5.0.4-10.5.i386.rpm
ef8fd8955b8eca84a87dd2bb4875b5bc  i386/php-snmp-5.0.4-10.5.i386.rpm
08ab3cfc4b59810ea71ea491e5cf5f5b  i386/php-xml-5.0.4-10.5.i386.rpm
ea658b8be0d1fba6df3828beeee9161c  i386/php-xmlrpc-5.0.4-10.5.i386.rpm
539f03c801b1c89e357f54f9626d62e8  i386/php-mbstring-5.0.4-10.5.i386.rpm
76c88d6a6b91d43ae6db7121d680fc03  i386/php-ncurses-5.0.4-10.5.i386.rpm
66362602f804499fefc5d3896257f223  i386/php-gd-5.0.4-10.5.i386.rpm
9fc87cc046b3e63701876459601ad917  i386/php-bcmath-5.0.4-10.5.i386.rpm
139d7077d1bca4c7795d29d649e7d64d  i386/php-dba-5.0.4-10.5.i386.rpm
e0f4ee2380b7823eede4fe04dd24fc85  i386/debug/php-debuginfo-5.0.4-10.5.i386.rpm

This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command.  
---------------------------------------------------------------------

-- 
fedora-announce-list mailing list
fedora-announce-list at redhat.com
https://www.redhat.com/mailman/listinfo/fedora-announce-list


More information about the UCI-Linux mailing list