Date: Sun, 15 Oct 2006 12:39:11 -0500 From: Jonathan Horne <freebsd@dfwlp.com> To: freebsd-questions@freebsd.org Subject: Re: PHP new vulnarabilities Message-ID: <200610151239.12127.freebsd@dfwlp.com> In-Reply-To: <20061015151215.15a4062e@loki.starkstrom.lan> References: <45322A1D.8070204@hadara.ps> <20061015151215.15a4062e@loki.starkstrom.lan>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sunday 15 October 2006 08:12, Joerg Pernfuss wrote: > On Sun, 15 Oct 2006 14:31:25 +0200 > > "Khaled J. Hussein" <khaled@hadara.ps> wrote: > > hi all > > > > last time i found this when i run portaudit -Fda > > > > Affected package: php5-5.1.6 > > Type of problem: php -- _ecalloc Integer Overflow Vulnerability. > > Reference: > > <http://www.FreeBSD.org/ports/portaudit/e329550b-54f7-11db-a5ae-00508d6a6 > >2df.html> > > > > how can i fix this > > update ypur portstree. you'll get php5-5.1.6_1 which fixes the _ecalloc > overflow, but not yet the open_basedir race condition. > > Joerg ive been scratching my head on this one for a few days too. i have a box at home, that is running 6.2-PRERELEASE. when i try to install the lang/php5 port, i get: [root@athena /usr/ports/lang/php5]# make install clean ===> php5-5.1.6_1 has known vulnerabilities: => php -- open_basedir Race Condition Vulnerability. Reference: <http://www.FreeBSD.org/ports/portaudit/edabe438-542f-11db-a5ae-00508d6a62df.html>; => Please update your ports tree and try again. *** Error code 1 Stop in /usr/ports/lang/php5. however, my server is running the same port, with no issue whatsoever. [root@zeus /etc/mail]# pkg_info | grep php5 php5-5.1.6_1 (and many extensions too) perplexing that one box could have it, while another one (using the same updated ports tree), refuses it. could be related to the code branch im following on my workstaion versus my server? thanks, jonathan
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200610151239.12127.freebsd>