The PHP development team would like to announce the immediate availability of PHP 5.2.13. This release focuses on improving the stability of the PHP 5.2.x branch with over 40 bug fixes, some of which are security related. All users of PHP 5.2 are encouraged to upgrade to this release. Reproducible: Always
Could the PHP herd please provide an ebuild for 5.2.13. Herd maintenance: Please note that php@ does not go anywhere. If your herd has been disbanded, please update metadata.xml for dev-lang/php; CCing last two committers in ChangeLog instead.
(In reply to comment #1) > Herd maintenance: Please note that php@ does not go anywhere. If your herd has > been disbanded, please update metadata.xml for dev-lang/php; CCing last two > committers in ChangeLog instead. The alias is php-bugs@
*** Bug 310083 has been marked as a duplicate of this bug. ***
Today I created a version bump for php 5.2.13 in my local overlay. Maybe it helps to bump php to 5.2.13 in the portage tree. I will attach the php-5.2.13.ebuild patch (against php-5.2.12.ebuild) and the php-patchset-5.2.13-r0.tar.bz2. The ebuild patch removes the removal of the bug16069.phpt test because it is not included into the php package anymore. The php patchset is just a copy of the 5.2.12-r0 patchset with the rename of "5.1.12" to "5.1.13" directory. Best regards.
Created attachment 224281 [details, diff] php 5.2.13 ebuild patch (against php-5.2.12.ebuild)
Created attachment 224283 [details] php patchset 5.2.13-r0
Created attachment 224291 [details, diff] php 5.2.13 ebuild patch (against php-5.2.12.ebuild)
Thanks for the patch, I just committed it to CVS. Arches, please test and mark stable: =dev-lang/php-5.2.13 Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86"
ppc64 done
Looks good here on x86 also.
compiles and looks good on amd64
x86 stable, thanks Andreas
ppc done
Stable for HPPA.
alpha/arm/ia64/s390/sh/sparc stable
amd64 confirmed. Tested on 2 machines.
amd64 stable, all arches done.
CVE-2010-1128 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1128): The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function. CVE-2010-1129 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1129): The safe_mode implementation in PHP before 5.2.13 does not properly handle directory pathnames that lack a trailing / (slash) character, which allows context-dependent attackers to bypass intended access restrictions via vectors related to use of the tempnam function. CVE-2010-1130 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1130): session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the session_save_path function, which allows context-dependent attackers to bypass open_basedir and safe_mode restrictions via an argument that contains multiple ; characters in conjunction with a .. (dot dot).
GLSA request filed.
Seeing B3 doesn't *require* a GLSA, please close this bug noglsa. It's been long overdue and there's a fresh security bug that is more important right now.
(In reply to comment #20) > Seeing B3 doesn't *require* a GLSA, please close this bug noglsa. It's been > long overdue and there's a fresh security bug that is more important right now. Yeah, you'd actually be right there. But when there are already bugs for which we need to issue a GLSA anyway, we also include others as well because it is only little more work for us.
CVE-2009-5016 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-5016): Integer overflow in the xml_utf8_decode function in ext/xml/xml.c in PHP before 5.2.11 makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string that uses overlong UTF-8 encoding, a different vulnerability than CVE-2010-3870.
This issue was resolved and addressed in GLSA 201110-06 at http://security.gentoo.org/glsa/glsa-201110-06.xml by GLSA coordinator Tobias Heinlein (keytoaster).
