Multiple vulnerabilities have been fixed in PHP, which can be exploited by malicious users to bypass certain security restrictions.
------------------------------------------------------------------------
Pardus Linux Security Advisory 2010-44 security@pardus.org.tr
------------------------------------------------------------------------
Date: 2010-03-29
Severity: 3
Type: Remote
------------------------------------------------------------------------
Summary
======
Multiple vulnerabilities have been fixed in PHP, which can be exploited
by malicious users to bypass certain security restrictions.
Description
==========
Fixed safe_mode validation inside tempnam() when the directory path does
not end with a /). (Martin Jansen)
Fixed a possible open_basedir/safe_mode bypass in session extension
identified by Grzegorz Stachowiak. (Ilia)
Improved LCG entropy. (Rasmus, Samy Kamkar)
Affected packages:
mod_php-5.2.13-76-11, all before 2009
php-cli-5.2.13-76-11, all before 2009
mod_php-5.2.13-75-15, all before 2008
php-cli-5.2.13-75-15, all before 2008
Resolution
=========
There are update(s) for mod_php-5.2.13-76-11, php-cli-5.2.13-76-11,
mod_php-5.2.13-75-15, php-cli-5.2.13-75-15. You can update them via
Package Manager or with a single command from console:
pisi up mod_php-5.2.13-76-11 php-cli-5.2.13-76-11 mod_php-5.2.13-75-15 php-cli-5.2.13-75-15
References
=========
* http://bugs.pardus.org.tr/show_bug.cgi?id363
* http://www.php.net/
------------------------------------------------------------------------