United States : 
Unknown Browser
www.ltdw.net 
Articles Sécurité Mandriva Security [Security Announce] [ MDVSA-2009:065 ] php4
Articles Sécurité Mandriva Security [Security Announce] [ MDVSA-2009:065 ] php4
| [Security Announce] [ MDVSA-2009:065 ] php4 |
 |
 |
 |
(0 Votes)| Écrit par Administrator |
| Vendredi, 06 Mars 2009 19:30 |
|
_______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2009:065 http://www.mandriva.com/security/ _______________________________________________________________________ Package : php4 Date : March 5, 2009 Affected: Corporate 4.0 _______________________________________________________________________ Problem Description: A vulnerability in the cURL library in PHP allowed context-dependent attackers to bypass safe_mode and open_basedir restrictions and read arbitrary files using a special URL request (CVE-2007-4850). improve mbfl_filt_conv_html_dec_flush() error handling in ext/mbstring/libmbfl/filters/mbfilter_htmlent.c (CVE-2008-5557). PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server (CVE-2009-0754). The updated packages have been patched to correct these issues. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4850 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5557 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0754 _______________________________________________________________________ Updated Packages: Corporate 4.0: 2dfd22f70a79140151e37ffc650ce562 corporate/4.0/i586/libphp4_common4-4.4.4-1.10.20060mlcs4.i586.rpm 1e7cfaacc2f0de74932c952002090c7e corporate/4.0/i586/php4-cgi-4.4.4-1.10.20060mlcs4.i586.rpm 70891521326ccf379ffcade515c07638 corporate/4.0/i586/php4-cli-4.4.4-1.10.20060mlcs4.i586.rpm e040b7271eeecdc71fa3d2bcb7da2bb6 corporate/4.0/i586/php4-curl-4.4.4-1.2.20060mlcs4.i586.rpm fe575f3f07a86d419eff519bde3510ea corporate/4.0/i586/php4-devel-4.4.4-1.10.20060mlcs4.i586.rpm 16fb016459d51d6455f0c51cd912efdb corporate/4.0/i586/php4-mbstring-4.4.4-1.2.20060mlcs4.i586.rpm 4059cd9721229c87b25b6e4743f13c48 corporate/4.0/SRPMS/php4-4.4.4-1.10.20060mlcs4.src.rpm 813154bf139d89573632a45437136e73 corporate/4.0/SRPMS/php4-curl-4.4.4-1.2.20060mlcs4.src.rpm 2df4a7ca570808691586f52452b5601e corporate/4.0/SRPMS/php4-mbstring-4.4.4-1.2.20060mlcs4.src.rpm Corporate 4.0/X86_64: 8e35646c4b35628a85dd76a8f0473464 corporate/4.0/x86_64/lib64php4_common4-4.4.4-1.10.20060mlcs4.x86_64.rpm 448245361dff74604f72cbfe3f0273fc corporate/4.0/x86_64/php4-cgi-4.4.4-1.10.20060mlcs4.x86_64.rpm 377cc8202704396841dd767975373ac4 corporate/4.0/x86_64/php4-cli-4.4.4-1.10.20060mlcs4.x86_64.rpm cc6e7fb2188ab99c9f2fe4ee0ab07bfb corporate/4.0/x86_64/php4-curl-4.4.4-1.2.20060mlcs4.x86_64.rpm 98b50b1c01f816a916a24dac82bd45f4 corporate/4.0/x86_64/php4-devel-4.4.4-1.10.20060mlcs4.x86_64.rpm c8231e042b861977f9b17ba47b4bb8a7 corporate/4.0/x86_64/php4-mbstring-4.4.4-1.2.20060mlcs4.x86_64.rpm 4059cd9721229c87b25b6e4743f13c48 corporate/4.0/SRPMS/php4-4.4.4-1.10.20060mlcs4.src.rpm 813154bf139d89573632a45437136e73 corporate/4.0/SRPMS/php4-curl-4.4.4-1.2.20060mlcs4.src.rpm 2df4a7ca570808691586f52452b5601e corporate/4.0/SRPMS/php4-mbstring-4.4.4-1.2.20060mlcs4.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ 
|