Bug 401999

Summary:	dev-lang/php-5.3.9 remote code execution
Product:	Gentoo Linux	Reporter:	Jack Lloyd <lloyd>
Component:	New packages	Assignee:	Gentoo Linux bug wranglers <bug-wranglers>
Status:	RESOLVED DUPLICATE
Severity:	critical
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Jack Lloyd 2012-02-02 22:37:07 UTC

5.3.9's implementation of max_input_vars has a serious bug that can lead to remote code execution:

http://thexploit.com/sec/critical-php-remote-vulnerability-introduced-in-fix-for-php-hashtable-collision-dos/

PHP 5.3.10 has already been released, notes "Fixed arbitrary remote code execution vulnerability reported by Stefan Esser, CVE-2012-0830."

Surprised there doesn't seem to already be an open issue for this.

Reproducible: Always

Comment 1 Alex Legler (RETIRED) archtester

2012-02-02 22:47:21 UTC


*** This bug has been marked as a duplicate of bug 401997 ***

Comment 2 Alex Legler (RETIRED) archtester

2012-02-02 22:47:43 UTC

Also, read the instructions on the file bug page next time thoroughly.