Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 401999 - dev-lang/php-5.3.9 remote code execution
Summary: dev-lang/php-5.3.9 remote code execution
Status: RESOLVED DUPLICATE of bug 401997
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: New packages (show other bugs)
Hardware: All Linux
: Normal critical (vote)
Assignee: Gentoo Linux bug wranglers
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-02-02 22:37 UTC by Jack Lloyd
Modified: 2012-02-02 22:47 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jack Lloyd 2012-02-02 22:37:07 UTC 
5.3.9's implementation of max_input_vars has a serious bug that can lead to remote code execution:

http://thexploit.com/sec/critical-php-remote-vulnerability-introduced-in-fix-for-php-hashtable-collision-dos/

PHP 5.3.10 has already been released, notes "Fixed arbitrary remote code execution vulnerability reported by Stefan Esser, CVE-2012-0830."

Surprised there doesn't seem to already be an open issue for this.

Reproducible: Always
Comment 1 Alex Legler (RETIRED) archtester gentoo-dev Security 2012-02-02 22:47:21 UTC 

*** This bug has been marked as a duplicate of bug 401997 ***
Comment 2 Alex Legler (RETIRED) archtester gentoo-dev Security 2012-02-02 22:47:43 UTC 
Also, read the instructions on the file bug page next time thoroughly.