[slackware-security]  php (SSA:2007-053-01)

New php packages are available for Slackware 10.2 and 11.0 to improve the
stability and security of PHP.  Quite a few bugs were fixed -- please
see http://www.php.net for a detailed list.  All sites that use PHP are
encouraged to upgrade.  Please note that we haven't tested all PHP
applications for backwards compatibility with this new upgrade, so you
should have the old package on hand just in case.

Both PHP 4.4.5 and PHP 5.2.1 updates have been provided.

Some of these issues have been assigned CVE numbers and may be referenced
in the Common Vulnerabilities and Exposures (CVE) database:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0906
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0907
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0908
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0909
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0910
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0988


Here are the details from the Slackware 11.0 ChangeLog:
+--------------------------+
patches/packages/php-4.4.5-i486-1_slack11.0.tgz:
  Upgraded to php-4.4.5 which improves stability and security.
  For complete details, see http://www.php.net.
  For imformation about some of the security fixes, see:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0906
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0907
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0908
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0909
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0910
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0988
  (* Security fix *)
extra/php5/php-5.2.1-i486-1_slack11.0.tgz:
  Upgraded to php-5.2.1 which improves stability and security.
  For imformation about some of the security fixes, see:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0906
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0907
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0908
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0909
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0910
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0988
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

HINT:  Getting slow download speeds from ftp.slackware.com?
Give slackware.osuosl.org a try.  This is another primary FTP site
for Slackware that can be considerably faster than downloading
from ftp.slackware.com.

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating additional FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated packages for Slackware 10.2:
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/php-4.4.5-i486-1_slack10.2.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/testing/packages/php-5.2.1/php-5.2.1-i486-1_slack10.2.tgz

Updated packages for Slackware 11.0:
ftp://ftp.slackware.com/pub/slackware/slackware-11.0/patches/packages/php-4.4.5-i486-1_slack11.0.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-11.0/extra/php5/php-5.2.1-i486-1_slack11.0.tgz


MD5 signatures:
+-------------+

Slackware 10.2 packages:
9910a0b1e46d10583b6d2f6588e13457  php-4.4.5-i486-1_slack10.2.tgz
6f4eb9e2bb286cb33bf8f450e458025e  php-5.2.1-i486-1_slack10.2.tgz

Slackware 11.0 packages:
4e312abf50feeedfe50a1fcddbd4cb2a  php-4.4.5-i486-1_slack11.0.tgz
be96edf4afb6b554b22df5f30a8d2b9b  php-5.2.1-i486-1_slack11.0.tgz


Installation instructions:
+------------------------+

First, stop apache:
# apachectl stop

Next, upgrade to the new PHP package:
# upgradepkg php-4.4.5-i486-1_slack11.0.tgz

Finally, restart apache:
# apachectl start  (or: apachectl startssl)


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com