Security World: [SECURITY] [DSA-2089-1] New php5 packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-2089-1 security@debian.org
http://www.debian.org/security/ Raphael Geissert
August 6, 2010 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : php5
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2010-1917 CVE-2010-2225

Several remote vulnerabilities have been discovered in PHP 5, an hypertext
preprocessor. The Common Vulnerabilities and Exposures project
identifies the following problems:

CVE-2010-1917

The fnmatch function can be abused to conduct denial of service
attacks (by crashing the interpreter) by the means of a stack overflow.

CVE-2010-2225

The SplObjectStorage unserializer allows attackers to execute
arbitrary code via serialized data by the means of a use-after-free
vulnerability.

MOPS-60

The default sessions serializer does not correctly handle a special
marker, which allows an attacker to inject arbitrary variables into the
session and possibly exploit vulnerabilities in the unserializer.

For the vulnerability described by CVE-2010-1128 (predictable entropy
for the Linear Congruential Generator used to generate session ids,) we
do not consider upstream's solution to be sufficient. It is recommended
to uncomment the 'session.entropy_file' and 'session.entropy_length'
settings in the php.ini files.
Further improvements can be achieved by setting 'session.hash_function'
to 1 (one) and incrementing the value of 'session.entropy_length.'

For the stable distribution (lenny), these problems have been fixed in
version 5.2.6.dfsg.1-1+lenny9.

For the testing distribution (squeeze) and the unstable distribution (sid),
these problems will be fixed soon.

We recommend that you upgrade your php5 packages.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 5.0 (stable) alias lenny
- --------------------------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/p/php5/php5_5.2.6.dfsg.1.orig.tar.gz
Size/MD5 checksum: 12173741 b80fcee38363f031229368ceff8ced58
http://security.debian.org/pool/updates/main/p/php5/php5_5.2.6.dfsg.1-1+lenny9.dsc
Size/MD5 checksum: 2529 8ccce2ae78389fdf093fc638b9d61152
http://security.debian.org/pool/updates/main/p/php5/php5_5.2.6.dfsg.1-1+lenny9.diff.gz
Size/MD5 checksum: 177397 32868c2bc5907ebeae509a5ae9e27fca

Architecture independent packages:

http://security.debian.org/pool/updates/main/p/php5/php-pear_5.2.6.dfsg.1-1+lenny9_all.deb
Size/MD5 checksum: 334570 a919de2518302133307c52d8e59841e9
http://security.debian.org/pool/updates/main/p/php5/php5_5.2.6.dfsg.1-1+lenny9_all.deb
Size/MD5 checksum: 1082 8eaf906c353774e361210ccce0d3999e

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

armel architecture (ARM EABI)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkxboMkACgkQYy49rUbZzloQzwCfUhVaIT2aHQvAFidNM8LdOE9l
DM8AoJyEJoMuCC6jFgURVaoNWwhAWLGM
=kbKX
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: http://lists.debian.org/201008060142.40216.geissert@debian.org

Security World

Search This Blog

Thursday, August 05, 2010

[SECURITY] [DSA-2089-1] New php5 packages fix several vulnerabilities

No comments: