------------------------------------------------------------------------
Pardus Linux Security Advisory 2008-81            security@pardus.org.tr
------------------------------------------------------------------------
     Date: 2008-12-23
 Severity: 3
     Type: Remote
------------------------------------------------------------------------

Summary
=======

Some vulnerabilities have been reported in  PHP,  where  some  have  an
unknown impact and others can potentially  be  exploited  by  malicious
people to cause a DoS (Denial of Service) or  compromise  a  vulnerable
system.


Description
===========

1) An input validation error exists within the "ZipArchive::extractTo()"

function when extracting ZIP archives. This can be exploited to extract
files

to arbitrary locations outside the specified  directory  via  directory
traversal

sequences in a specially crafted ZIP archive.



2) An error in the included PCRE library can be exploited  to  cause  a
buffer

overflow.



3) The problem is that the "BG(page_uid)" and "BG(page_gid)"  variables
are not

initialized. No further information is currently available.



4) The problem is that the "php_value" order is incorrect for Apache

configurations. No further information is currently available.



5) An error in the GD library can be exploited to cause a crash  via  a
specially

crafted font file.



NOTE: Additionally a  potential  buffer  overflow  in  the  "memnstr()"
function and

crashes in the FastCGI functionality and the  IMAP  toolkit  have  been
fixed.


Affected packages:

 Pardus 2008:
   php-common, all before 5.2.8-67-7
   php-cli-5.2.8, all before 67-7
   mod_php, all before 5.2.8-67-7

 Pardus 2007:
   php-common, all before 5.2.8-60-29
   php-cli, all before 5.2.8-60-38
   mod_php, all before 5.2.8-60-61


Resolution
==========

There are update(s) for php-common, php-cli-5.2.8, mod_php, php-cli. You
can update them via Package Manager  or  with  a  single  command  from
console:

 Pardus 2008:
   pisi up php-common php-cli-5.2.8 mod_php

 Pardus 2007:
   pisi up php-common php-cli mod_php


References
==========

 * http://bugs.pardus.org.tr/show_bug.cgi?id=8784
 * http://secunia.com/Advisories/32964

-----------------------------------------------------------------------

--
Pardus Security Team
http://security.pardus.org.tr


_______________________________________________
Pardus-security mailing list
Pardus-security@pardus.org.tr
http://liste.pardus.org.tr/mailman/listinfo/pardus-security