USN-989-1: PHP vulnerabilities
20 September 2010
Releases
Packages
- php5 -
Details
Auke van Slooten discovered that PHP incorrectly handled certain xmlrpc
requests. An attacker could exploit this issue to cause the PHP server to
crash, resulting in a denial of service. This issue only affected Ubuntu
6.06 LTS, 8.04 LTS, 9.04 and 9.10. (CVE-2010-0397)
It was discovered that the pseudorandom number generator in PHP did not
provide the expected entropy. An attacker could exploit this issue to
predict values that were intended to be random, such as session cookies.
This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.04 and 9.10.
(CVE-2010-1128)
It was discovered that PHP did not properly handle directory pathnames that
lacked a trailing slash character. An attacker could exploit this issue to
bypass safe_mode restrictions. This issue only affected Ubuntu 6.06 LTS,
8.04 LTS, 9.04 and 9.10. (CVE-2010-1129)
Grzegorz Stachowiak discovered that the PHP session extension did not
properly handle semicolon characters. An attacker could exploit this issue
to bypass safe_mode restrictions. This issue only affected Ubuntu 8.04 LTS,
9.04 and 9.10. (CVE-2010-1130)
Stefan Esser discovered that PHP incorrectly decoded remote HTTP chunked
encoding streams. An attacker could exploit this issue to cause the PHP
server to crash and possibly execute arbitrary code with application
privileges. This issue only affected Ubuntu 10.04 LTS. (CVE-2010-1866)
Mateusz Kocielski discovered that certain PHP SQLite functions incorrectly
handled empty SQL queries. An attacker could exploit this issue to possibly
execute arbitrary code with application privileges. (CVE-2010-1868)
Mateusz Kocielski discovered that PHP incorrectly handled certain arguments
to the fnmatch function. An attacker could exploit this flaw and cause the
PHP server to consume all available stack memory, resulting in a denial of
service. (CVE-2010-1917)
Stefan Esser discovered that PHP incorrectly handled certain strings in the
phar extension. An attacker could exploit this flaw to possibly view
sensitive information. This issue only affected Ubuntu 10.04 LTS.
(CVE-2010-2094, CVE-2010-2950)
Stefan Esser discovered that PHP incorrectly handled deserialization of
SPLObjectStorage objects. A remote attacker could exploit this issue to
view sensitive information and possibly execute arbitrary code with
application privileges. This issue only affected Ubuntu 8.04 LTS, 9.04,
9.10 and 10.04 LTS. (CVE-2010-2225)
It was discovered that PHP incorrectly filtered error messages when limits
for memory, execution time, or recursion were exceeded. A remote attacker
could exploit this issue to possibly view sensitive information.
(CVE-2010-2531)
Stefan Esser discovered that the PHP session serializer incorrectly handled
the PS_UNDEF_MARKER marker. An attacker could exploit this issue to alter
arbitrary session variables. (CVE-2010-3065)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 9.10
-
php5-cli
-
5.2.10.dfsg.1-2ubuntu6.5
-
php5-cgi
-
5.2.10.dfsg.1-2ubuntu6.5
-
libapache2-mod-php5
-
5.2.10.dfsg.1-2ubuntu6.5
Ubuntu 9.04
-
php5-cli
-
5.2.6.dfsg.1-3ubuntu4.6
-
php5-cgi
-
5.2.6.dfsg.1-3ubuntu4.6
-
libapache2-mod-php5
-
5.2.6.dfsg.1-3ubuntu4.6
Ubuntu 8.04
Ubuntu 6.06
Ubuntu 10.04
In general, a standard system update will make all the necessary changes.