Bugzilla Bug 201885

I committed php-5.2.5-r1 to the tree two days ago. It fixes the following
security issues:

 1. stream_wrapper_register() crashes with long strings passed as second
    argument, also affects a lot more functions (all functions in PHP
    which take a class name; basically any code path which uses do_alloca()),
    for example: is_subclass_of(), get_class_vars(), class_exists(),
    property_exists(), get_class_methods() and probably many more;
    (CVE-2007-6039)
 2. xmlrpc_server_call_method() crash
 3. multiple getopt() crashes
 4. phpbug #43092 (curl_copy_handle() crashes with > 32 chars long URL)
 5. Fixed bug #43301 (mb_ereg*_replace() crashes when replacement string is
    invalid PHP expression and 'e' option is used)
 6. phpbug #42978 pdo_pgsql bound param mismatch crash
 7. phpbug #43377 DateTimeZone invalid arg crash
 8. phpbug #43386 uninitialized array_globals (unverified possible crash)
 9. uninitialized sapi_headers.mimetype (unverified possible crash)
10. phpbug #43495 array_merge_recursive() crash

All of them are (possible) crash bugs and there is no statement on whether it
is possible to (locally) execute code. Some upstream dev at least suspected
issue #1 to be exploitable to run arbitrary code.

php-5.2.5-r1 is ready to be stabled, in my opinion (no bugs, test suite shows
no regressions, running just fine on two systems of mine).

Rating A4 as local crash issues are not subject to the Vulnerability Policy.
Stabling as a precautionary measure for issue (1).

Arches, please test and mark stable dev-lang/php-5.2.5-r1.
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86"

x86 stable, though i'm not sure src_unpack() code. 
php: Can you double check it please?

cla, I don't see any problems with src_unpack. Although I'm working on
improving the ebuild itself, it hasn't changed at all between 5.2.5 and
5.2.5-r1 (except patchset revision and suhosin), so not sure what you want me
to verify or check.

Removing arm/s390/sh from CC as they already stabled it.

alpha/ia64/sparc stable

Stable for HPPA.

ppc and ppc64 stable

on amd64:

the src_unpack() stuff is slightly disturbing to see(warning from aclocal
flying by). Other than that it copmiles and installs just fine. Phpmyadmin
still works, as does mythweb. Please stable.

Portage 2.1.3.19 (default-linux/amd64/2007.0, gcc-4.1.2, glibc-2.6.1-r0,
2.6.17-gentoo-r8 x86_64)
=================================================================
System uname: 2.6.17-gentoo-r8 x86_64 AMD Turion(tm) 64 Mobile Technology MT-37
Timestamp of tree: Sat, 15 Dec 2007 01:47:01 +0000
distcc 2.18.3 x86_64-pc-linux-gnu (protocols 1 and 2) (default port 3632)
[disabled]
app-shells/bash:     3.2_p17
dev-lang/python:     2.4.4-r6
dev-python/pycrypto: 2.0.1-r6
sys-apps/baselayout: 1.12.9-r2
sys-apps/sandbox:    1.2.18.1-r2
sys-devel/autoconf:  2.13, 2.61-r1
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10
sys-devel/binutils:  2.18-r1
sys-devel/gcc-config: 1.3.16
sys-devel/libtool:   1.5.24
virtual/os-headers:  2.6.22-r2
ACCEPT_KEYWORDS="amd64"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=athlon64 -O2 -pipe"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/X11/xkb"
CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/php/apache2-php5/ext-active/
/etc/php/cgi-php5/ext-active/ /etc/php/cli-php5/ext-active/ /etc/revdep-rebuild
/etc/terminfo /etc/udev/rules.d"
CXXFLAGS="-march=athlon64 -O2 -pipe"
DISTDIR="/distfiles"
FEATURES="distlocks metadata-transfer sandbox sfperms strict unmerge-orphans
userfetch"
GENTOO_MIRRORS="http://distfiles.gentoo.org
http://distro.ibiblio.org/pub/linux/distributions/gentoo"
LANG="en_US.utf-8"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --delete-after --stats --timeout=180
--exclude=/distfiles --exclude=/local --exclude=/packages
--filter=H_**/files/digest-*"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/overlay"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="acl amd64 apache apache2 bash-completion berkdb cli contrarius cracklib
cran crypt cups dhcp gd glsa gpm iconv inquisitio logrotate midi mmx mpeg2
mudflap mysql mysqli mythtv ncurses nfs nls nptl nptlonly openmp pcre perl php
portage python qa readline reflection ruby session spl sse sse2 ssl tcpd
unicode ups usb v4l v4l2 vfat vim-syntax zlib" ALSA_CARDS="ali5451 als4000
atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968
fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx
via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop
empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi
null plug rate route share shm softvol" APACHE2_MODULES="actions alias
auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm
authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache
dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache
filter headers include info log_config logio mem_cache mime mime_magic
negotiation rewrite setenvif speling status unique_id userdir usertrack
vhost_alias" ELIBC="glibc" INPUT_DEVICES="keyboard mouse evdev" KERNEL="linux"
LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses
text" USERLAND="GNU" VIDEO_CARDS="via"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, LDFLAGS,
LINGUAS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS

Stable on amd64, thanks gentoofan23

I tend to vote NO.

I vote no - unless someone comes up with something more than vague suspicions.

Reverting to full NO and closing.

Does not affect current (2008.0) release. Removing release.