From owner-freebsd-ports-bugs@FreeBSD.ORG Fri Sep 7 18:40:01 2007 Return-Path: Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id BFDDD16A41B for ; Fri, 7 Sep 2007 18:40:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id A300B13C46E for ; Fri, 7 Sep 2007 18:40:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.1/8.14.1) with ESMTP id l87Ie1vq070534 for ; Fri, 7 Sep 2007 18:40:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.1/8.14.1/Submit) id l87Ie1tl070533; Fri, 7 Sep 2007 18:40:01 GMT (envelope-from gnats) Resent-Date: Fri, 7 Sep 2007 18:40:01 GMT Resent-Message-Id: <200709071840.l87Ie1tl070533@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Nick Barkas Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 225B316A41A for ; Fri, 7 Sep 2007 18:31:24 +0000 (UTC) (envelope-from snb@smtp.earth.threerings.net) Received: from smtp.earth.threerings.net (smtp1.earth.threerings.net [64.127.109.108]) by mx1.freebsd.org (Postfix) with ESMTP id 0A26A13C478 for ; Fri, 7 Sep 2007 18:31:24 +0000 (UTC) (envelope-from snb@smtp.earth.threerings.net) Received: by smtp.earth.threerings.net (Postfix, from userid 10038) id 9F98A61E3C; Fri, 7 Sep 2007 11:02:52 -0700 (PDT) Message-Id: <20070907180252.9F98A61E3C@smtp.earth.threerings.net> Date: Fri, 7 Sep 2007 11:02:52 -0700 (PDT) From: Nick Barkas To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: Subject: ports/116182: [patch] security/vuxml add vulnerabilities in php5 < 5.2.4 X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Nick Barkas List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Sep 2007 18:40:01 -0000 >Number: 116182 >Category: ports >Synopsis: [patch] security/vuxml add vulnerabilities in php5 < 5.2.4 >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: update >Submitter-Id: current-users >Arrival-Date: Fri Sep 07 18:40:01 GMT 2007 >Closed-Date: >Last-Modified: >Originator: Nick Barkas >Release: FreeBSD 6.2-RELEASE-p4 i386 >Organization: Three Rings Design >Environment: System: FreeBSD mail1.earth.threerings.net 6.2-RELEASE-p4 FreeBSD 6.2-RELEASE-p4 #0: Thu Apr 26 17:55:55 UTC 2007 root@i386-builder.daemonology.net:/usr/obj/usr/src/sys/SMP i386 >Description: PHP 5 versions before 5.2.4 have numerous security vulnerabilities. This updates the VuXML document to notify users of PHP < 5.2.4 that they should upgrade. >How-To-Repeat: >Fix: --- vuxml.patch begins here --- diff -urN vuxml.orig/vuln.xml vuxml/vuln.xml --- vuxml.orig/vuln.xml Wed Sep 5 04:26:31 2007 +++ vuxml/vuln.xml Fri Sep 7 10:25:20 2007 @@ -34,6 +34,75 @@ --> + + php -- multiple vulnerabilities + + + php5 + 5.2.4 + + + + +

The PHP development team reports:

+
+

Security Enhancements and Fixes in PHP 5.2.4:

+
    +
  • Fixed a floating point exception inside wordwrap() (Reported + by Mattias Bengtsson)
    • +
  • Fixed several integer overflows inside the GD extension + (Reported by Mattias Bengtsson)
    • +
  • Fixed size calculation in chunk_split() (Reported by Gerhard + Wagner)
    • +
  • Fixed integer overflow in str[c]spn(). (Reported by Mattias + Bengtsson)
    • +
  • Fixed money_format() not to accept multiple %i or %n tokens. + (Reported by Stanislav Malyshev)
    • +
  • Fixed zend_alter_ini_entry() memory_limit interruption + vulnerability. (Reported by Stefan Esser)
    • +
  • Fixed INFILE LOCAL option handling with MySQL extensions not + to be allowed when open_basedir or safe_mode is active. (Reported + by Mattias Bengtsson)
    • +
  • Fixed session.save_path and error_log values to be checked + against open_basedir and safe_mode (CVE-2007-3378) (Reported by + Maksymilian Arciemowicz)
    • +
  • Fixed a possible invalid read in glob() win32 implementation + (CVE-2007-3806) (Reported by shinnai)
    • +
  • Fixed a possible buffer overflow in php_openssl_make_REQ + (Reported by zatanzlatan at hotbrev dot com)
    • +
  • Fixed an open_basedir bypass inside glob() function (Reported + by dr at peytz dot dk)
    • +
  • Fixed a possible open_basedir bypass inside session extension + when the session file is a symlink (Reported by c dot i dot morris + at durham dot ac dot uk)
    • +
  • Improved fix for MOPB-03-2007.
    • +
  • Corrected fix for CVE-2007-2872.
    • +
+
+ + + + CVE-2007-3996 + CVE-2007-3997 + CVE-2007-3998 + CVE-2007-4652 + CVE-2007-4657 + CVE-2007-4658 + CVE-2007-4659 + CVE-2007-4660 + CVE-2007-4661 + CVE-2007-4662 + CVE-2007-4663 + CVE-2007-4670 + http://www.php.net/releases/5_2_4.php + http://secunia.com/advisories/26642 + + + 2007-08-30 + 2007-09-07 + + + rkhunter -- insecure temporary file creation --- vuxml.patch ends here --- >Release-Note: >Audit-Trail: >Unformatted: