Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 476570 (CVE-2013-4113) - <dev-lang/php-{5.3.27,5.4.18}: Array index error, leading to invalid free in the XML extension (CVE-2013-4113)
Summary: <dev-lang/php-{5.3.27,5.4.18}: Array index error, leading to invalid free in ...
Status: RESOLVED FIXED
Alias: CVE-2013-4113
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: A2 [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2013-07-11 19:42 UTC by Agostino Sarubbo
Modified: 2014-08-31 11:26 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2013-07-11 19:42:47 UTC
From ${URL} :

An array index error, leading to invalid free flaw was found in the way XML extension of PHP, a 
scripting language for creating dynamic web sites, used to convert certain XML files into PHP 
language internal structures. Remote attacker could provide a specially-crafted XML file, that when 
opened in an PHP application would lead to that application crash or, potentially, arbitrary code 
execution with the privileges of the user running the application.

References:
[1] http://php.net/archive/2013.php#id2013-07-11-1
[2] http://php.net/ChangeLog-5.php

Upstream bug report:
[3] https://bugs.php.net/bug.php?id=65236

Relevant patch:
[4] https://bugs.php.net/patch-display.php?bug_id=65236&patch=bug65236.diff&revision=latest


@maintainer(s): after the bump, in case we need to stabilize the package, please say explicitly if it is ready for the stabilization or not.
Comment 1 Ole Markus With (RETIRED) gentoo-dev 2013-07-12 12:17:26 UTC
Ebuild in the tree. Go ahead and stabilise if necessary.
Comment 2 Chris Reffett gentoo-dev Security 2013-07-12 21:03:14 UTC
Stable request updated in bug 476570.
Comment 3 Agostino Sarubbo gentoo-dev 2013-08-16 19:41:15 UTC
@php can we stabilize 5.4.18?
Comment 4 GLSAMaker/CVETool Bot gentoo-dev 2013-08-27 03:20:08 UTC
CVE-2013-4113 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4113):
  ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth,
  which allows remote attackers to cause a denial of service (heap memory
  corruption) or possibly have unspecified other impact via a crafted document
  that is processed by the xml_parse_into_struct function.
Comment 5 Chris Reffett gentoo-dev Security 2013-09-25 14:24:52 UTC
Will handle stabilizing in bug 483212.
Comment 6 Yury German Gentoo Infrastructure gentoo-dev Security 2014-06-16 05:49:44 UTC
Added to an existing GLSA request.
Comment 7 GLSAMaker/CVETool Bot gentoo-dev 2014-08-31 10:49:30 UTC
This issue was resolved and addressed in
 GLSA 201408-11 at http://security.gentoo.org/glsa/glsa-201408-11.xml
by GLSA coordinator Kristian Fiskerstrand (K_F).
Comment 8 GLSAMaker/CVETool Bot gentoo-dev 2014-08-31 11:26:18 UTC
This issue was resolved and addressed in
 GLSA 201408-11 at http://security.gentoo.org/glsa/glsa-201408-11.xml
by GLSA coordinator Kristian Fiskerstrand (K_F).