Skip to navigation

Security Advisory Moderate: php security update

Advisory: RHSA-2007:0891-5
Type: Security Advisory
Severity: Moderate
Issued on: 2007-10-25
Last updated on: 2007-10-25
Affected Products: Red Hat Application Stack v1 for Enterprise Linux AS (v.4)
Red Hat Application Stack v1 for Enterprise Linux ES (v.4)
CVEs (cve.mitre.org): CVE-2007-2756
CVE-2007-2872
CVE-2007-3799
CVE-2007-3996
CVE-2007-3998
CVE-2007-4658
CVE-2007-4670

Details

Updated PHP packages that fix several security issues are now available for
Red Hat Application Stack.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache
HTTP Web server.

These updated packages address the following vulnerabilities:

Various integer overflow flaws were found in the PHP gd extension. A
script that could be forced to resize images from an untrusted source could
possibly allow a remote attacker to execute arbitrary code as the apache
user. (CVE-2007-3996)

An integer overflow flaw was found in the PHP chunk_split function. If a
remote attacker was able to pass arbitrary data to the third argument of
chunk_split they could possibly execute arbitrary code as the apache user.
Note that it is unusual for a PHP script to use the chunk_script function
with a user-supplied third argument. (CVE-2007-2872)

A previous security update introduced a bug into PHP session cookie
handling. This could allow an attacker to stop a victim from viewing a
vulnerable web site if the victim has first visited a malicious web page
under the control of the attacker, and that page can set a cookie for the
vulnerable web site. (CVE-2007-4670)

A flaw was found in the PHP money_format function. If a remote attacker
was able to pass arbitrary data to the money_format function this could
possibly result in an information leak or denial of service. Note that is
is unusual for a PHP script to pass user-supplied data to the money_format
function. (CVE-2007-4658)

A flaw was found in the PHP wordwrap function. If a remote attacker was
able to pass arbitrary data to the wordwrap function this could possibly
result in a denial of service. (CVE-2007-3998)

A bug was found in PHP session cookie handling. This could allow an
attacker to create a cross-site cookie insertion attack if a victim follows
an untrusted carefully-crafted URL. (CVE-2007-3799)

An infinite-loop flaw was discovered in the PHP gd extension. A script
that could be forced to process PNG images from an untrusted source could
allow a remote attacker to cause a denial of service. (CVE-2007-2756)

Users of PHP should upgrade to these updated packages which contain
backported patches to correct these issues.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Updated packages

Red Hat Application Stack v1 for Enterprise Linux AS (v.4)

SRPMS:
php-5.1.6-3.el4s1.8.src.rpm
File outdated by:  RHSA-2008:0582
    MD5: 5a5a93ea5e81fd4432071154467d55b2
 
IA-32:
php-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: f1c52f8badcbf8a02590cf030c73e8b2
php-bcmath-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 6167cad0145903ca5ce649042bc118e2
php-cli-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 72d49a3c7a73ee813b4eaf14abec105d
php-common-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 6d7b667d87a970e99567dcc2c5dd01c0
php-dba-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 195c2d08b5b332aaf6dd5b286c7fdc4d
php-devel-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: c5da559c8d4bb7e3e5fa0ca7a0846272
php-gd-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 4448f622d41047f70e5efb05092b28e6
php-imap-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 13549ef2f56cf39213411c974dc25511
php-ldap-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 557b76135e9ca5b5be3a068afb176d2c
php-mbstring-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: fd5d5c58dfc2ab580d51a33443243120
php-mysql-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 2b48409dce9bdcc6e9af76e512fce9e6
php-ncurses-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 4c4ca089595dbad0d002b60f92ff687d
php-odbc-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 2aa0c5973aa47a0c7389f1a98902eac7
php-pdo-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: bee9d1881d4e48e013c6b02045212d72
php-pgsql-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 16cc1a7ea42c1dfa162b04a29b8744f7
php-snmp-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 727852222040bb489a2c422adcd07095
php-soap-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 895121dd4d3467132f8c7d0deb89d03e
php-xml-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: a79fdb3ccceec34644499cd36763cbcb
php-xmlrpc-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 6fbac183b81ce2d0335ff495f6975826
 
x86_64:
php-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: a03004e6fc62309fc53c8aed9037ec3c
php-bcmath-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: a7004bcf974fee87a93e29d8f09e2864
php-cli-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: 42d8fe8df8fc88fce408e9a74082b1ec
php-common-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: 3fff0d6177109b60b0c71d1674d2b426
php-dba-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: 424626a6d5c2cdeadb1bd83dd3625b36
php-devel-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: 27e5b064afba826d0bc730213d4e0a62
php-gd-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: a46bc2a96e2fd3be080c8deeb02417db
php-imap-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: dd6b22f140922f0a6eed431215db2f90
php-ldap-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: 0a400488fe0e9eca51a37f49b92b8dff
php-mbstring-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: ad082a623b672b555a1246d71d46fd5b
php-mysql-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: 9d2df5c954e70f58a4cb157f672e1684
php-ncurses-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: 0531af6e0d8272df2b9886f8d3dc92fe
php-odbc-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: ac4c00d2126af30777d44cdc8e2a02b4
php-pdo-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: 8224c48bf245ff54f7483cb9c2bf3a2c
php-pgsql-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: e74d967c5f590b6e5191d65821fd0ce7
php-snmp-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: d2a65e385b3ea99d833d4af8e8991257
php-soap-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: 51c6db19ebd3b1a473aaa20670025c26
php-xml-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: 7afc87f20da8aeee286a68be9202ce8b
php-xmlrpc-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: 1ab5380da805b9cb87ab7879316bddac
 
Red Hat Application Stack v1 for Enterprise Linux ES (v.4)

SRPMS:
php-5.1.6-3.el4s1.8.src.rpm
File outdated by:  RHSA-2008:0582
    MD5: 5a5a93ea5e81fd4432071154467d55b2
 
IA-32:
php-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: f1c52f8badcbf8a02590cf030c73e8b2
php-bcmath-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 6167cad0145903ca5ce649042bc118e2
php-cli-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 72d49a3c7a73ee813b4eaf14abec105d
php-common-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 6d7b667d87a970e99567dcc2c5dd01c0
php-dba-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 195c2d08b5b332aaf6dd5b286c7fdc4d
php-devel-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: c5da559c8d4bb7e3e5fa0ca7a0846272
php-gd-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 4448f622d41047f70e5efb05092b28e6
php-imap-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 13549ef2f56cf39213411c974dc25511
php-ldap-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 557b76135e9ca5b5be3a068afb176d2c
php-mbstring-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: fd5d5c58dfc2ab580d51a33443243120
php-mysql-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 2b48409dce9bdcc6e9af76e512fce9e6
php-ncurses-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 4c4ca089595dbad0d002b60f92ff687d
php-odbc-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 2aa0c5973aa47a0c7389f1a98902eac7
php-pdo-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: bee9d1881d4e48e013c6b02045212d72
php-pgsql-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 16cc1a7ea42c1dfa162b04a29b8744f7
php-snmp-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 727852222040bb489a2c422adcd07095
php-soap-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 895121dd4d3467132f8c7d0deb89d03e
php-xml-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: a79fdb3ccceec34644499cd36763cbcb
php-xmlrpc-5.1.6-3.el4s1.8.i386.rpm
File outdated by:  RHSA-2008:0582
    MD5: 6fbac183b81ce2d0335ff495f6975826
 
x86_64:
php-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: a03004e6fc62309fc53c8aed9037ec3c
php-bcmath-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: a7004bcf974fee87a93e29d8f09e2864
php-cli-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: 42d8fe8df8fc88fce408e9a74082b1ec
php-common-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: 3fff0d6177109b60b0c71d1674d2b426
php-dba-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: 424626a6d5c2cdeadb1bd83dd3625b36
php-devel-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: 27e5b064afba826d0bc730213d4e0a62
php-gd-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: a46bc2a96e2fd3be080c8deeb02417db
php-imap-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: dd6b22f140922f0a6eed431215db2f90
php-ldap-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: 0a400488fe0e9eca51a37f49b92b8dff
php-mbstring-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: ad082a623b672b555a1246d71d46fd5b
php-mysql-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: 9d2df5c954e70f58a4cb157f672e1684
php-ncurses-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: 0531af6e0d8272df2b9886f8d3dc92fe
php-odbc-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: ac4c00d2126af30777d44cdc8e2a02b4
php-pdo-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: 8224c48bf245ff54f7483cb9c2bf3a2c
php-pgsql-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: e74d967c5f590b6e5191d65821fd0ce7
php-snmp-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: d2a65e385b3ea99d833d4af8e8991257
php-soap-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: 51c6db19ebd3b1a473aaa20670025c26
php-xml-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: 7afc87f20da8aeee286a68be9202ce8b
php-xmlrpc-5.1.6-3.el4s1.8.x86_64.rpm
File outdated by:  RHSA-2008:0582
    MD5: 1ab5380da805b9cb87ab7879316bddac
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

242032 - CVE-2007-2872 php chunk_split integer overflow
242033 - CVE-2007-2756 php imagecreatefrompng infinite loop
250726 - CVE-2007-3799 php cross-site cookie insertion
276081 - CVE-2007-3998 php floating point exception inside wordwrap
278011 - CVE-2007-4658 php money_format format string issue
278031 - CVE-2007-3996 php multiple integer overflows in gd
278041 - CVE-2007-4670 php malformed cookie handling


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/