Bugzilla Bug 169372

XSS in phpinfo()

Reproducible: Always

Steps to Reproduce:
POC:

http://localhost/phpinfo.php?a[]=<script>alert(/XSS/);</script>

Here we'll handle the bugs for this month of PHP bugs that are not already
fixed in 4.4.6, and 5.2.1-r* at the same time (unfortunately 5.1 will contain
remaining issues). Status is [upstream]

If you find bugs that are already fixed in our versions, please comment on
bug 153911 instead (status [stable])


* phpinfo() XSS

*** Bug 169498 has been marked as a duplicate of this bug. ***

*** Bug 170583 has been marked as a duplicate of this bug. ***

Two issues (20 and 21) with bypass of safemode and openbasedir with
compressions:

PHP compress.bzip2:// URL Wrapper safemode and open_basedir Bypass
Vulnerability 
PHP zip:// URL Wrapper safemode and open_basedir Bypass Vulnerability

Both unfixed in 5.2.1.

MOPB-22, MOPB-23, MOPB-24, all unfixed in 5.2.1

PHP team, do you know if there is a planned upstream upgrade after this Month?

http://ilia.ws/archives/165-5.2.2RC1-Released-for-Testing.html

Probably add this p.mask'ed?

Mandriva just fixed these ones:

CVE-2007-1001
CVE-2007-1285
CVE-2007-1286
CVE-2007-1711
CVE-2007-1718

Btw isn't it around time that we get the PHP issues cleaned up?

And Ubuntu fixed these:
CVE-2007-1375
CVE-2007-1376
CVE-2007-1380
CVE-2007-1484
CVE-2007-1521
CVE-2007-1583
CVE-2007-1700
CVE-2007-1718
CVE-2007-1824
CVE-2007-1887
CVE-2007-1888
CVE-2007-1900

I know, just waiting on upstream to release 5.2.2, which should be this week,
I'll keep you updated.
Best regards, CHTEKK.

*** Bug 177015 has been marked as a duplicate of this bug. ***

(In reply to comment #10)
> I know, just waiting on upstream to release 5.2.2, which should be this week,
> I'll keep you updated.
> Best regards, CHTEKK.

4.4.7/5.5.2 is out... 

*** Bug 177016 has been marked as a duplicate of this bug. ***

*** Bug 177169 has been marked as a duplicate of this bug. ***

*** Bug 177201 has been marked as a duplicate of this bug. ***

PHP 4.4.7 is also released, so fix should be out.. ??

(In reply to comment #16)
> PHP 4.4.7 is also released, so fix should be out.. ??

Please, stop producing even more unproductive noise here. 

Ebuilds for 4.4.7 and 5.2.2 are ready, I'm only waiting on Suhosin to update
its patches, then they will go into the tree, so just be patient, thanks. ;)
Best regards, CHTEKK.

@CHTEKK:
http://www.hardened-php.net/suhosin/_media/suhosin-patch-5.2.2rc2-0.9.6.2.patch.gz
applies cleanly to 5.2.2-release btw...

PHP 4.4.7 and PHP 5.2.2 are in the tree, with updated Suhosin support.
Enjoy as always, best regards, CHTEKK.

Thx Luca.

Arches please test and mark stable. Target keywords are:

php-4.4.7.ebuild:KEYWORDS="alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc
x86 ~x86-fbsd"

php-5.2.2-r1.ebuild:KEYWORDS="alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc
x86 ~x86-fbsd"

It also appears to fix:

CVE-2007-2509
CVE-2007-2510
CVE-2007-2511

ppc stable

sparc stable.

ia64 + x86 stable

Status in alpha:

- 4.4.7 have the same failing tests that were present in bug 153911.
Marked stable.

- 5.2.1 presents some new failing tests: 

--------------------
Bug #40236 (php -a function allocation eats memory) [Zend/tests/bug40236.phpt]
Bug #16069 [ext/iconv/tests/bug16069.phpt]
iconv stream filter [ext/iconv/tests/iconv_stream_filter.phpt]
touch() tests [ext/standard/tests/file/touch.phpt]
phpinfo() CGI [ext/standard/tests/general_functions/phpinfo2.phpt]
CLI long options [sapi/cli/tests/015.phpt]
--------------------

I expect the usual Lucca's OK to go for the stable keyword in php5
Thanks.

(In reply to comment #26)
> Bug #40236 (php -a function allocation eats memory) [Zend/tests/bug40236.phpt]
> Bug #16069 [ext/iconv/tests/bug16069.phpt]
> iconv stream filter [ext/iconv/tests/iconv_stream_filter.phpt]
> touch() tests [ext/standard/tests/file/touch.phpt]
> phpinfo() CGI [ext/standard/tests/general_functions/phpinfo2.phpt]
> CLI long options [sapi/cli/tests/015.phpt]

The first one is the only real new one in 5.2.2, the 2 iconv tests fail since
forever and the other three failures were always present in 5.2 series (at
least on my x86/amd64 test boxes). php -a still works fine here, so I'd say
5.2.2 can be stabled safely.
Thanks and best regards, CHTEKK.

Failed tests in dev-lang/php5.2.2-r1 on HPPA (excluding all tests mentioned
above):

easter_date() [ext/calendar/tests/easter_date.phpt]
unixtojd() [ext/calendar/tests/unixtojd.phpt]
Bug #36436 DBA problem with Berkeley DB4 [ext/dba/tests/bug36436.phpt]
DBA DB4 handler test [ext/dba/tests/dba_db4.phpt]
gmp_divexact() tests (OK to fail with GMP =< 4.2.1) [ext/gmp/tests/011.phpt]
IPv6 Loopback test [ext/sockets/tests/ipv6loop.phpt]
Generic pack()/unpack() tests [ext/standard/tests/strings/pack.phpt]
microtime() function [ext/standard/tests/time/001.phpt] (warn: system
dependent)
libtidy handling of 'new-blocklevel-tags' [ext/tidy/tests/024.phpt]

Failed tests in dev-lang/php-4.4.7 on HPPA (excluding all tests mentioned
above):

DBA DB4 handler test [ext/dba/tests/dba_db4.phpt]
microtime() function [ext/standard/tests/time/001.phpt] (warn: system
dependent)

(In reply to comment #28)
> Failed tests in dev-lang/php5.2.2-r1 on HPPA (excluding all tests mentioned
> above):
> 
> easter_date() [ext/calendar/tests/easter_date.phpt]
> unixtojd() [ext/calendar/tests/unixtojd.phpt]

Known to fail in 5.2 series.

> Bug #36436 DBA problem with Berkeley DB4 [ext/dba/tests/bug36436.phpt]
> DBA DB4 handler test [ext/dba/tests/dba_db4.phpt]

New ones, probably related to newer DB4's? Still, nothing to worry about.

> gmp_divexact() tests (OK to fail with GMP =< 4.2.1) [ext/gmp/tests/011.phpt]

There only is 4.2.1 in the tree, so this is expected to fail.

> IPv6 Loopback test [ext/sockets/tests/ipv6loop.phpt]
> Generic pack()/unpack() tests [ext/standard/tests/strings/pack.phpt]
> microtime() function [ext/standard/tests/time/001.phpt] (warn: system
> dependent)

System dependant, the IPv6 one I know to fail and iirc the pack stuff also
changes depending on arch.

> libtidy handling of 'new-blocklevel-tags' [ext/tidy/tests/024.phpt]

Yup, because the libtidy version we have in the tree doesn't implement those
tags, and the test fails.

(In reply to comment #29)
> Failed tests in dev-lang/php-4.4.7 on HPPA (excluding all tests mentioned
> above):
> 
> DBA DB4 handler test [ext/dba/tests/dba_db4.phpt]
> microtime() function [ext/standard/tests/time/001.phpt] (warn: system
> dependent)

As above, probably related to BDB version, and the other is even warned to be
system dependant.
All in all, I'd say you can stable both PHPs on HPPA too without worries.
Best regards and thanks, CHTEKK.

AMD64 done.
Best regards, CHTEKK.

alpha stable.

Thanks guys.

Both stable for HPPA.

ppc64 stable.

sorry for being late.

oh btw, it was glsa 200705-19, sorry for the late.