Skip to navigation

Security Advisory Important: php security update

Advisory: RHSA-2007:0154-4
Type: Security Advisory
Severity: Important
Issued on: 2007-04-16
Last updated on: 2007-04-16
Affected Products: Red Hat Enterprise Linux AS (v. 2.1)
Red Hat Enterprise Linux ES (v. 2.1)
Red Hat Enterprise Linux WS (v. 2.1)
Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor
CVEs (cve.mitre.org): CVE-2007-1285
CVE-2007-1286
CVE-2007-1711

Details

Updated PHP packages that fix several security issues are now available for
Red Hat Enterprise Linux 2.1.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache
HTTP Web server.

A denial of service flaw was found in the way PHP processed a deeply nested
array. A remote attacker could cause the PHP interpreter to crash by
submitting an input variable with a deeply nested array. (CVE-2007-1285)

A flaw was found in the way PHP's unserialize() function processes data. If
a remote attacker is able to pass arbitrary data to PHP's unserialize()
function, it may be possible for them to execute arbitrary code as the
apache user. (CVE-2007-1286)

A double free flaw was found in PHP's session_decode() function. If a
remote attacker is able to pass arbitrary data to PHP's session_decode()
function, it may be possible for them to execute arbitrary code as the
apache user. (CVE-2007-1711)

Users of PHP should upgrade to these updated packages which contain
backported patches to correct these issues.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Updated packages

Red Hat Enterprise Linux AS (v. 2.1)

SRPMS:
php-4.1.2-2.17.src.rpm
File outdated by:  RHSA-2008:0546
    MD5: 9820e0982acdf72a0f8c9af02f4e5f6a
 
IA-32:
php-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 856a5725715e6d970d7fe5fce209780c
php-devel-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 98b74cc772436080d6f1b0b08e4a5690
php-imap-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 403e01c242b079c3988c25c6406c3734
php-ldap-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: e2cc407fd74569e37e95f27f0aa0c873
php-manual-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: b6876b825654e6dd9cd5b400da47611c
php-mysql-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 442f5cacbbf06f9a3b6e1d359c9acd55
php-odbc-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 8ba4b70e2f358f4c35775b90b955e88e
php-pgsql-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 03b45786fdaea33bcc179b2d375f9995
 
IA-64:
php-4.1.2-2.17.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: f03338d56473c9c2af996e5de897d843
php-devel-4.1.2-2.17.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: d3d03471a50878eb9330ca226ce47da9
php-imap-4.1.2-2.17.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: efe489bd298c35685ba6127ebcb67575
php-ldap-4.1.2-2.17.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: a35e27188fb680cd0f192ea85065f7ae
php-manual-4.1.2-2.17.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: 22aed8fc2144c5e23ffb65aeb792b8fa
php-mysql-4.1.2-2.17.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: abc59cffe540ebdc24d968ae3bb716c7
php-odbc-4.1.2-2.17.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: 58fefa66509e3babfecb58f2642116e8
php-pgsql-4.1.2-2.17.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: c603a39fcf3876c7e6123c6725e12b8e
 
Red Hat Enterprise Linux ES (v. 2.1)

SRPMS:
php-4.1.2-2.17.src.rpm
File outdated by:  RHSA-2008:0546
    MD5: 9820e0982acdf72a0f8c9af02f4e5f6a
 
IA-32:
php-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 856a5725715e6d970d7fe5fce209780c
php-devel-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 98b74cc772436080d6f1b0b08e4a5690
php-imap-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 403e01c242b079c3988c25c6406c3734
php-ldap-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: e2cc407fd74569e37e95f27f0aa0c873
php-manual-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: b6876b825654e6dd9cd5b400da47611c
php-mysql-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 442f5cacbbf06f9a3b6e1d359c9acd55
php-odbc-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 8ba4b70e2f358f4c35775b90b955e88e
php-pgsql-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 03b45786fdaea33bcc179b2d375f9995
 
Red Hat Enterprise Linux WS (v. 2.1)

SRPMS:
php-4.1.2-2.17.src.rpm
File outdated by:  RHSA-2008:0546
    MD5: 9820e0982acdf72a0f8c9af02f4e5f6a
 
IA-32:
php-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 856a5725715e6d970d7fe5fce209780c
php-devel-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 98b74cc772436080d6f1b0b08e4a5690
php-imap-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 403e01c242b079c3988c25c6406c3734
php-ldap-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: e2cc407fd74569e37e95f27f0aa0c873
php-manual-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: b6876b825654e6dd9cd5b400da47611c
php-mysql-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 442f5cacbbf06f9a3b6e1d359c9acd55
php-odbc-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 8ba4b70e2f358f4c35775b90b955e88e
php-pgsql-4.1.2-2.17.i386.rpm
File outdated by:  RHSA-2008:0546
    MD5: 03b45786fdaea33bcc179b2d375f9995
 
Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor

SRPMS:
php-4.1.2-2.17.src.rpm
File outdated by:  RHSA-2008:0546
    MD5: 9820e0982acdf72a0f8c9af02f4e5f6a
 
IA-64:
php-4.1.2-2.17.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: f03338d56473c9c2af996e5de897d843
php-devel-4.1.2-2.17.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: d3d03471a50878eb9330ca226ce47da9
php-imap-4.1.2-2.17.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: efe489bd298c35685ba6127ebcb67575
php-ldap-4.1.2-2.17.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: a35e27188fb680cd0f192ea85065f7ae
php-manual-4.1.2-2.17.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: 22aed8fc2144c5e23ffb65aeb792b8fa
php-mysql-4.1.2-2.17.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: abc59cffe540ebdc24d968ae3bb716c7
php-odbc-4.1.2-2.17.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: 58fefa66509e3babfecb58f2642116e8
php-pgsql-4.1.2-2.17.ia64.rpm
File outdated by:  RHSA-2008:0546
    MD5: c603a39fcf3876c7e6123c6725e12b8e
 

Bugs fixed (see bugzilla for more information)

235225 - CVE-2007-1285 Multiple "Month of PHP Bugs" PHP issues (CVE-2007-1286, CVE-2007-1711)


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/