Skip to navigation

Security Advisory Important: php security update

Advisory: RHSA-2007:0081-2
Type: Security Advisory
Severity: Important
Issued on: 2007-02-21
Last updated on: 2007-02-21
Affected Products: Red Hat Enterprise Linux AS (v. 2.1)
Red Hat Enterprise Linux ES (v. 2.1)
Red Hat Enterprise Linux WS (v. 2.1)
Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor
CVEs (cve.mitre.org): CVE-2007-0906
CVE-2007-0907
CVE-2007-0908
CVE-2007-0909
CVE-2007-0910
CVE-2007-0988
CVE-2007-1380
CVE-2007-1701
CVE-2007-1825

Details

Updated PHP packages that fix several security issues are now available for
Red Hat Enterprise Linux 2.1.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache
HTTP Web server.

A number of buffer overflow flaws were found in the PHP session extension;
the str_replace() function; and the imap_mail_compose() function. If very
long strings were passed to the str_replace() function, an integer
overflow could occur in memory allocation. If a script used the
imap_mail_compose() function to create a new MIME message based on an
input body from an untrusted source, it could result in a heap overflow.
An attacker with access to a PHP application affected by any these issues
could trigger the flaws and possibly execute arbitrary code as the
'apache' user. (CVE-2007-0906)

When unserializing untrusted data on 64-bit platforms, the
zend_hash_init() function could be forced into an infinite loop, consuming
CPU resources for a limited time, until the script timeout alarm aborted
execution of the script. (CVE-2007-0988)

If the wddx extension was used to import WDDX data from an untrusted
source, certain WDDX input packets could expose a random portion of heap
memory. (CVE-2007-0908)

If the odbc_result_all() function was used to display data from a database,
and the database table contents were under an attacker's control, a format
string vulnerability was possible which could allow arbitrary code
execution. (CVE-2007-0909)

A one byte memory read always occurs before the beginning of a buffer. This
could be triggered, for example, by any use of the header() function in a
script. However it is unlikely that this would have any effect.
(CVE-2007-0907)

Several flaws in PHP could allow attackers to "clobber" certain
super-global variables via unspecified vectors. (CVE-2007-0910)

Users of PHP should upgrade to these updated packages which contain
backported patches to correct these issues.

Red Hat would like to thank Stefan Esser for his help diagnosing these issues.


Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Updated packages

Red Hat Enterprise Linux AS (v. 2.1)

SRPMS:
php-4.1.2-2.14.src.rpm
File outdated by:  RHSA-2008:0546
    MD5: 3c1babd0b650d968fb05c3fc941e1328
 
IA-32:
php-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: a4e8107d7d04c391924e1a489c4e8b1f
php-devel-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 3eb84ba09f48aafdd82fd273847c0ab7
php-imap-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 547ee3ef9a42650b7968ca5d847cb362
php-ldap-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 27ad3782dd0bd6c398f6759c615a7a8e
php-manual-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 8f5cb33e88ebc83c80fd69608daa943b
php-mysql-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 13f14591befae51d6c2072e29190510e
php-odbc-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 3c5a5d6027e2f960091044d63205e00b
php-pgsql-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: b14c7e1d15965c39febb475897ec9602
 
IA-64:
php-4.1.2-2.14.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: e62f6a7585c07440f283543af205720c
php-devel-4.1.2-2.14.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: ddb2e7b85468f5c222ba1f09fcfdad9c
php-imap-4.1.2-2.14.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: b8f556303277dc3847d24acff42d530f
php-ldap-4.1.2-2.14.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: 444ae771d27b6eb5a4b9fc20df23ee46
php-manual-4.1.2-2.14.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: d95de85e804a28dfbf0e1cf2dee9b184
php-mysql-4.1.2-2.14.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: 5e8f596c3109b090b1de0b40faa3575c
php-odbc-4.1.2-2.14.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: b017004385456310eaf7108b5e48a1fd
php-pgsql-4.1.2-2.14.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: 2b0984f7324d18f6f605b16ab0e0bcc1
 
Red Hat Enterprise Linux ES (v. 2.1)

SRPMS:
php-4.1.2-2.14.src.rpm
File outdated by:  RHSA-2008:0546
    MD5: 3c1babd0b650d968fb05c3fc941e1328
 
IA-32:
php-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: a4e8107d7d04c391924e1a489c4e8b1f
php-devel-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 3eb84ba09f48aafdd82fd273847c0ab7
php-imap-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 547ee3ef9a42650b7968ca5d847cb362
php-ldap-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 27ad3782dd0bd6c398f6759c615a7a8e
php-manual-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 8f5cb33e88ebc83c80fd69608daa943b
php-mysql-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 13f14591befae51d6c2072e29190510e
php-odbc-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 3c5a5d6027e2f960091044d63205e00b
php-pgsql-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: b14c7e1d15965c39febb475897ec9602
 
Red Hat Enterprise Linux WS (v. 2.1)

SRPMS:
php-4.1.2-2.14.src.rpm
File outdated by:  RHSA-2008:0546
    MD5: 3c1babd0b650d968fb05c3fc941e1328
 
IA-32:
php-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: a4e8107d7d04c391924e1a489c4e8b1f
php-devel-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 3eb84ba09f48aafdd82fd273847c0ab7
php-imap-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 547ee3ef9a42650b7968ca5d847cb362
php-ldap-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 27ad3782dd0bd6c398f6759c615a7a8e
php-manual-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 8f5cb33e88ebc83c80fd69608daa943b
php-mysql-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 13f14591befae51d6c2072e29190510e
php-odbc-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 3c5a5d6027e2f960091044d63205e00b
php-pgsql-4.1.2-2.14.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: b14c7e1d15965c39febb475897ec9602
 
Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor

SRPMS:
php-4.1.2-2.14.src.rpm
File outdated by:  RHSA-2008:0546
    MD5: 3c1babd0b650d968fb05c3fc941e1328
 
IA-64:
php-4.1.2-2.14.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: e62f6a7585c07440f283543af205720c
php-devel-4.1.2-2.14.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: ddb2e7b85468f5c222ba1f09fcfdad9c
php-imap-4.1.2-2.14.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: b8f556303277dc3847d24acff42d530f
php-ldap-4.1.2-2.14.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: 444ae771d27b6eb5a4b9fc20df23ee46
php-manual-4.1.2-2.14.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: d95de85e804a28dfbf0e1cf2dee9b184
php-mysql-4.1.2-2.14.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: 5e8f596c3109b090b1de0b40faa3575c
php-odbc-4.1.2-2.14.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: b017004385456310eaf7108b5e48a1fd
php-pgsql-4.1.2-2.14.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: 2b0984f7324d18f6f605b16ab0e0bcc1
 

Bugs fixed (see bugzilla for more information)

229332 - CVE-2007-0906 PHP security issues (CVE-2007-0907, CVE-2007-0908, CVE-2007-0909, CVE-2007-0910, CVE-2007-0988)


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/