Bugzilla Bug 198446

From the upstream bug:

<snip>
Description:
------------

When inserting a blob and the value turns out to be a URL, MDB2 will replace
the value with a handle to the URL and the driver will fetch the URL and put
its contents into the blob field instead of the URL itself literally.

A programmer using MDB2 could easily make a textarea as an input to a blob
field. but if he was unaware of the situation (and LOB handling is currently
not very well documented), a visitor could input a URL and the application will
fetch the URL instead of storing the literal URL itself. and the URL here could
be something not normally accessible to the public (when the web server 
is on DMZ, it could have access to a resource behind the firewall).

or worse, it looks like it also accepts file:/ URLs. he could input something
like file:///etc/passwd or file:///etc/my.cnf and the server will happily get
it for him.
<snip>

This is fixed in 2.5.0_alpha1 (added an option to turn lob_allow_url_include
off by default)

InCVS now; and since the current stable deps won't work w/ the new
dev-php/PEAR-MDB2...

Target keywords: alpha amd64 hppa ia64 ppc ppc64 sparc x86
dev-php/PEAR-MDB2-2.5.0_alpha1
dev-php/PEAR-MDB2_Driver_mssql-1.3.0_alpha1
dev-php/PEAR-MDB2_Driver_mysql-1.5.0_alpha1
dev-php/PEAR-MDB2_Driver_mysqli-1.5.0_alpha1
dev-php/PEAR-MDB2_Driver_pgsql-1.5.0_alpha1
dev-php/PEAR-MDB2_Driver_sqlite-1.5.0_alpha1

Target keywords: amd64 x86
dev-php/PEAR-MDB2_Driver_oci8-1.5.0_alpha1

Enjoy! ;)

Thanks, Jakub.

ppc64 stable

alpha/ia64/sparc/x86 stable

Stable for HPPA.

amd64 stable

ppc stable

It's information leak, but leaking the whole /etc/passwd is not nice, so voting
yes.

voting YES too, request filed.

GLSA 200712-05

Does not affect current (2008.0) release. Removing release.