Pardus: Php Multiple Vulnerabilities

Posted by Bill Keys
Some vulnerabilities have been reported in PHP, where some have an unknown impact and others can potentially be exploited by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system.

------------------------------------------------------------------------
Pardus Linux Security Advisory 2008-81            security@pardus.org.tr
------------------------------------------------------------------------
     Date: 2008-12-23
 Severity: 3
     Type: Remote
------------------------------------------------------------------------

Summary
=======

Some vulnerabilities have been reported in  PHP,  where  some  have  an
unknown impact and others can potentially  be  exploited  by  malicious
people to cause a DoS (Denial of Service) or  compromise  a  vulnerable
system.


Description
===========

1) An input validation error exists within the "ZipArchive::extractTo()"

function when extracting ZIP archives. This can be exploited to extract
files

to arbitrary locations outside the specified  directory  via  directory
traversal

sequences in a specially crafted ZIP archive.



2) An error in the included PCRE library can be exploited  to  cause  a
buffer

overflow.



3) The problem is that the "BG(page_uid)" and "BG(page_gid)"  variables
are not

initialized. No further information is currently available.



4) The problem is that the "php_value" order is incorrect for Apache

configurations. No further information is currently available.



5) An error in the GD library can be exploited to cause a crash  via  a
specially

crafted font file.



NOTE: Additionally a  potential  buffer  overflow  in  the  "memnstr()"
function and

crashes in the FastCGI functionality and the  IMAP  toolkit  have  been
fixed.


Affected packages:

 Pardus 2008:
   php-common, all before 5.2.8-67-7
   php-cli-5.2.8, all before 67-7
   mod_php, all before 5.2.8-67-7

 Pardus 2007:
   php-common, all before 5.2.8-60-29
   php-cli, all before 5.2.8-60-38
   mod_php, all before 5.2.8-60-61


Resolution
==========

There are update(s) for php-common, php-cli-5.2.8, mod_php, php-cli. You
can update them via Package Manager  or  with  a  single  command  from
console:

 Pardus 2008:
   pisi up php-common php-cli-5.2.8 mod_php

 Pardus 2007:
   pisi up php-common php-cli mod_php


References
==========

 * http://bugs.pardus.org.tr/show_bug.cgi?id=8784
 * http://secunia.com/Advisories/32964

-----------------------------------------------------------------------

--
Pardus Security Team
http://security.pardus.org.tr


_______________________________________________
Pardus-security mailing list
Pardus-security@pardus.org.tr
http://liste.pardus.org.tr/mailman/listinfo/pardus-security