php-4.4.8_pre20070816 is flagged with four GLSA: 200610-14 ( PHP: Integer overflow ) 200608-28 ( PHP: Arbitary code execution ) 200703-21 ( PHP: Multiple vulnerabilities ) 200705-19 ( PHP: Multiple vulnerabilities ) *Sigh* ... sorry for bringing this up :-/
(In reply to comment #0) > php-4.4.8_pre20070816 is flagged with four GLSA: > > 200610-14 ( PHP: Integer overflow ) > 200608-28 ( PHP: Arbitary code execution ) > 200703-21 ( PHP: Multiple vulnerabilities ) > 200705-19 ( PHP: Multiple vulnerabilities ) These GLSAs really need to be fixed properly. I'd suggest marking all of them not vulnerable for >=dev-lang/php-4.4.8 so this doesn't reoccur for every new minor version of PHP.
(In reply to comment #1) > These GLSAs really need to be fixed properly. I'd suggest marking all of them > not vulnerable for >=dev-lang/php-4.4.8 so this doesn't reoccur for every new > minor version of PHP. Ah, I see. That would mark them invulnerable for all versions of 5 too. *sigh* Guess the GLSAs will need to be fixed for every new point release in both slots. :-(
What really needs to be done is making GLSAs in general slot aware I guess. But right now, I can't really take them serious any more because in 99% of the cases it was just a php-update where nobody updated the GLSAs. And that is a serious problem.
Anyhow, if someone could fix it by marking 4.4.8_pre not vulnerable, it would make the tweak at least for now... Same problem for mysql -- except that there is no 4.1 version corrected yet...
we have had this issue in the past with other packages. please add the specific 4.4.8_x versions to the glsas. thanks.
While the GLSAs do not describe php-4 issues only, it's still correct now. php-4 is supposed to be considered vulnerable, so I think this can be closed now.
as explained on bug #189172, PHP-4 users are strongly advised to upgrade to PHP-5 anyway, so closing this one.
Php 4 is supposed to be vulnerable to 200710-02, but not by 200610-14, 200608-28, 200703-21 and 200705-19. And upgrading to php-5 is not as simple, they're not compatible (but it's true Gentoo can't do little with it ... maybee ... what about using some patches backported by debian ? How much vulnerable are they ?).
(In reply to comment #8) > And upgrading to php-5 is not as simple, > they're not compatible (but it's true Gentoo can't do little with it ... maybee > ... what about using some patches backported by debian ? How much vulnerable > are they ?). If you want to put the effort into that, try talking to the PHP team about maintaining PHP 4. You'd have to start by identifying for each of the issues covered by GLSA 200710-02 whether PHP 4 is affected and find/backport, verify and apply a patch for it.
