Summary: | dev-lang/php < 5.2.6-r6: arbitrary code execution, DoS, safe_mode bypass (CVE-2008-{3658,3659,3660}) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Christian Hoffmann (RETIRED) <hoffie> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | major | CC: | php-bugs |
Priority: | High | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
Whiteboard: | B1? [glsa] | ||
Package list: | Runtime testing required: | --- | |
Bug Depends on: | |||
Bug Blocks: | 228369 |
Description
Christian Hoffmann (RETIRED)
![]() Bleh, one of the patches introduces a strange segfault, which I am unable to track down quickly. This will have to wait for tomorrow then. *** Bug 229287 has been marked as a duplicate of this bug. *** #7 There was some memory corruption issue (would probably rather hard to exploit) See http://bugs.php.net/bug.php?id=45178 http://bugs.php.net/bug.php?id=33595 php-5.2.6-r6 is in the tree (the weird segfault I was referring to just happens in some edge cases and is not a regression, so this shouldn't prevent us from stabling this). Issue #6 was previously tracked in bug 229287, btw. Ready for stablization from my side. Arches, please test and stabilize: =dev-lang/php-5.2.6-r6 Target keywords: alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86 ~x86-fbsd To do: alpha arm hppa ia64 ppc ppc64 s390 sh sparc x86 Please note that there have been two versions of php-5.2.6-r6 in the tree. Both install the very same files, but the first version did not build on some systems. In short: If you see a build problem related to "yyerror" symbols, cvs up first. ;) ppc64 stable x86 stable, amd64 was already done by hoffie. Stable for HPPA. alpha/ia64/sparc stable ppc stable CVE-2008-3658: #2 (gd issue) CVE-2008-3659: #6 memnstr() overflow CVE-2008-3660: #3 FastCGI-related "foo..php" crash Debian classifies this as RCE (#2 and #6). http://www.debian.org/security/2008/dsa-1647 GLSA 200811-05, thanks everyone, especially hoffie. |