New PHP packages fix vulnerability in safemode

PHP versions earlier than 4.1.0 contain a vulnerability that could allow
arbitrary commands to be executed.

[updated 22 Aug 2002]
The initial set of errata packages contained an incorrect set of
dependencies. This meant that a number of packages would need to be
installed before php that were not essential to the operation of php.
Updated errata packages are included with this advisory that have corrected
dependencies.

PHP is an HTML-embedded scripting language commonly used with Apache. PHP
versions 4.0.5 through 4.1.0 in safe mode do not properly cleanse
the 5th parameter to the mail() function. This vulnerability allows local
users and possibly remote attackers to execute arbitrary commands via shell
metacharacters.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2001-1246 to this issue.

Red Hat Linux version 7.2 shipped with PHP 4.0.6 by default, which is
vulnerable to this issue.

Versions of Red Hat Linux before 7.2 shipped with an earlier version of PHP
not vulnerable to this issue. However, if the the most recent errata
(RHSA-2002:035) was applied to these systems, then they are vulnerable
and should be upgraded.

It is highly recommended that all users of PHP upgrade to these errata
packages, which are not vulnerable to this issue.

Please Note:

This PHP errata enforces memory limits on the size of the PHP process to
prevent a badly generated script from becoming a possible source for a
denial of service attack. The default process size is 8Mb though you can
adjust this as you deem necessary thought the php.ini directive
memory_limit. For example, to change the process memory limit to 4MB, add
the following:

memory_limit 4194304

Important Note:

There are special instructions you should follow regarding your
/etc/php.ini configuration file in the "Solution" section below.

Please note that the /etc/php.ini configuration file is not replaced or
overwritten. You should carefully review your configuration file and adapt
it to your server or service functions.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the
desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

72007 - php-4.1.2-7.3.3 update contains devel requires

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1246
http://online.securityfocus.com/archive/1/194425

5th, mail, parameter, PHP, safemode