ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1231-1] PHP Vulnerabilities (Steve Beattie)
----------------------------------------------------------------------
Message: 1
Date: Mon, 17 Oct 2011 23:39:17 -0700
From: Steve Beattie <sbeattie@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1231-1] PHP Vulnerabilities
Message-ID: <20111018063917.GA5570@nxnw.org>
Content-Type: text/plain; charset="us-ascii"
==========================================================================
Ubuntu Security Notice USN-1231-1
October 18, 2011
php5 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.10
- Ubuntu 10.04 LTS
- Ubuntu 8.04 LTS
Summary:
Several security issues were fixed in PHP.
Software Description:
- php5: HTML-embedded scripting language interpreter
Details:
Mateusz Kocielski, Marek Kroemeke and Filip Palian discovered that a
stack-based buffer overflow existed in the socket_connect function's
handling of long pathnames for AF_UNIX sockets. A remote attacker
might be able to exploit this to execute arbitrary code; however,
the default compiler options for affected releases should reduce
the vulnerability to a denial of service. This issue affected Ubuntu
10.04 LTS, Ubuntu 10.10 and Ubuntu 11.04. (CVE-2011-1938)
Krzysztof Kotowicz discovered that the PHP post handler function
does not properly restrict filenames in multipart/form-data POST
requests. This may allow remote attackers to conduct absolute
path traversal attacks and possibly create or overwrite arbitrary
files. This issue affected Ubuntu 8.04 LTS, Ubuntu 10.04 LTS, Ubuntu
10.10 and Ubuntu 11.04. (CVE-2011-2202)
It was discovered that the crypt function for blowfish does not
properly handle 8-bit characters. This could make it easier for an
attacker to discover a cleartext password containing an 8-bit character
that has a matching blowfish crypt value. This issue affected Ubuntu
10.04 LTS, Ubuntu 10.10 and Ubuntu 11.04. (CVE-2011-2483)
It was discovered that PHP did not properly check the return values of
the malloc(3), calloc(3) and realloc(3) library functions in multiple
locations. This could allow an attacker to cause a denial of service
via a NULL pointer dereference or possibly execute arbitrary code.
This issue affected Ubuntu 8.04 LTS, Ubuntu 10.04 LTS, Ubuntu 10.10
and Ubuntu 11.04. (CVE-2011-3182)
Maksymilian Arciemowicz discovered that PHP did not properly implement
the error_log function. This could allow an attacker to cause a denial
of service via an application crash. This issue affected Ubuntu 10.04
LTS, Ubuntu 10.10, Ubuntu 11.04 and Ubuntu 11.10. (CVE-2011-3267)
Maksymilian Arciemowicz discovered that the ZipArchive functions
addGlob() and addPattern() did not properly check their flag arguments.
This could allow a malicious script author to cause a denial of
service via application crash. This issue affected Ubuntu 10.04 LTS,
Ubuntu 10.10, Ubuntu 11.04 and Ubuntu 11.10. (CVE-2011-1657)
It was discovered that the Xend opcode parser in PHP could be interrupted
while handling the shift-left, shift-right, and bitwise-xor opcodes.
This could allow a malicious script author to expose memory
contents. This issue affected Ubuntu 10.04 LTS. (CVE-2010-1914)
It was discovered that the strrchr function in PHP could be interrupted
by a malicious script, allowing the exposure of memory contents. This
issue affected Ubuntu 8.04 LTS. (CVE-2010-2484)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 11.10:
libapache2-mod-php5 5.3.6-13ubuntu3.2
php5-cgi 5.3.6-13ubuntu3.2
php5-cli 5.3.6-13ubuntu3.2
php5-common 5.3.6-13ubuntu3.2
Ubuntu 11.04:
libapache2-mod-php5 5.3.5-1ubuntu7.3
php5-cgi 5.3.5-1ubuntu7.3
php5-cli 5.3.5-1ubuntu7.3
php5-common 5.3.5-1ubuntu7.3
Ubuntu 10.10:
libapache2-mod-php5 5.3.3-1ubuntu9.6
php5-cgi 5.3.3-1ubuntu9.6
php5-cli 5.3.3-1ubuntu9.6
php5-common 5.3.3-1ubuntu9.6
Ubuntu 10.04 LTS:
libapache2-mod-php5 5.3.2-1ubuntu4.10
php5-cgi 5.3.2-1ubuntu4.10
php5-cli 5.3.2-1ubuntu4.10
php5-common 5.3.2-1ubuntu4.10
Ubuntu 8.04 LTS:
libapache2-mod-php5 5.2.4-2ubuntu5.18
php5-cgi 5.2.4-2ubuntu5.18
php5-cli 5.2.4-2ubuntu5.18
php5-common 5.2.4-2ubuntu5.18
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1231-1
CVE-2010-1914, CVE-2010-2484, CVE-2011-1657, CVE-2011-1938,
CVE-2011-2202, CVE-2011-2483, CVE-2011-3182, CVE-2011-3267
Package Information:
https://launchpad.net/ubuntu/+source/php5/5.3.6-13ubuntu3.2
https://launchpad.net/ubuntu/+source/php5/5.3.5-1ubuntu7.3
https://launchpad.net/ubuntu/+source/php5/5.3.3-1ubuntu9.6
https://launchpad.net/ubuntu/+source/php5/5.3.2-1ubuntu4.10
https://launchpad.net/ubuntu/+source/php5/5.2.4-2ubuntu5.18
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20111017/7de9332a/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 85, Issue 8
*******************************************************
No comments:
Post a Comment