Fedora Legacy Test Update Notification: php

Mon Oct 4 03:39:49 UTC 2004

RH9 packages were updated to provide stripped binaries.
RH7.3 packages are unchanged.

---------------------------------------------------------------------
Fedora Legacy Test Update Notification
FEDORALEGACY-2004-1868
Bugzilla https://bugzilla.fedora.us/show_bug.cgi?id=1868
2004-10-04
---------------------------------------------------------------------

Name        : php
Versions    : 7.3: 4.1.2-7.3.10.legacy, 9: 4.2.2-17.7.legacy
Summary     : The PHP HTML-embedded scripting language.
Description : 
PHP is an HTML-embedded scripting language. PHP attempts to make it
easy for developers to write dynamically generated webpages. PHP also
offers built-in database integration for several commercial and
non-commercial database management systems, so writing a
database-enabled webpage with PHP is fairly simple. The most common
use of PHP coding is probably as a replacement for CGI scripts. The
mod_php module enables the Apache Web server to understand and process
the embedded PHP language in Web pages.

---------------------------------------------------------------------
Update Information:

Stefan Esser discovered a flaw when memory_limit is enabled in versions
of PHP 4 before 4.3.8. If a remote attacker could force the PHP
interpreter to allocate more memory than the memory_limit setting before
script execution begins, then the attacker may be able to supply the
contents of a PHP hash table remotely. This hash table could then be
used to execute arbitrary code as the 'apache' user. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CAN-2004-0594 to this issue.

This issue has a higher risk when PHP is running on an instance of
Apache which is vulnerable to CAN-2004-0493. It may also be possible to
exploit this issue if using a non-default PHP configuration with the
"register_defaults" setting is changed to "On".

Stefan Esser discovered a flaw in the strip_tags function in versions of
PHP before 4.3.8. The strip_tags function is commonly used by PHP
scripts to prevent Cross-Site-Scripting attacks by removing HTML tags
from user-supplied form data. By embedding NUL bytes into form data,
HTML tags can in some cases be passed intact through the strip_tags
function, which may allow a Cross-Site-Scripting attack. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CAN-2004-0595 to this issue.

---------------------------------------------------------------------
7.3 changelog:

* Thu Sep 30 2004 Marc Deslauriers <marcdeslauriers at videotron.ca>
4.1.2-7.3.10.legacy

- Added missing BuildRequires: sendmail

* Sun Aug 01 2004 John Dalbec <jpdalbec at ysu.edu> 4.1.2-7.3.9.legacy

- Added missing BuildRequires: flex mm-devel libtool

* Mon Jul 26 2004 Marc Deslauriers <marcdeslauriers at videotron.ca>
4.1.2-7.3.8.legacy

- Added better security fix for CAN-2004-0594
- Added fixes for various compiler warnings

* Thu Jul 15 2004 Marc Deslauriers <marcdeslauriers at videotron.ca>
4.1.2-7.3.7.legacy

- Added security fix for CAN-2004-0594
- Added security fix for CAN-2004-0595
- Added a few more fixes
- Added imap-devel BuildRequires

9 changelog:

* Sun Oct 03 2004 Marc Deslauriers <marcdeslauriers at videotron.ca>
4.2.2-17.7.legacy

- Rebuilt

* Thu Sep 30 2004 Marc Deslauriers <marcdeslauriers at videotron.ca>
4.2.2-17.6.legacy

- Added sendmail to BuildRequires

* Tue Sep 28 2004 Marc Deslauriers <marcdeslauriers at videotron.ca>
4.2.2-17.5.legacy

- Added flex and libtool to BuildRequires

* Mon Jul 26 2004 Marc Deslauriers <marcdeslauriers at videotron.ca>
4.2.2-17.4.legacy

- Added better security fix for CAN-2004-0594

* Thu Jul 15 2004 Marc Deslauriers <marcdeslauriers at videotron.ca>
4.2.2-17.3.legacy

- Added security fix for CAN-2004-0594
- Added security fix for CAN-2004-0595
- Added a few more fixes

---------------------------------------------------------------------
This update can be downloaded from:
  http://download.fedoralegacy.org/redhat/
(sha1sums)

6aaefdbf687f8dbf9ffc7b2ab0a0ff2914a13028 
redhat/7.3/updates-testing/i386/php-4.1.2-7.3.10.legacy.i386.rpm
3f38e8929822edc377f61a05c31e45c8599a4ba6 
redhat/7.3/updates-testing/i386/php-devel-4.1.2-7.3.10.legacy.i386.rpm
8c9ac5e7c5040b2d9cf75848acc1260842a5e4aa 
redhat/7.3/updates-testing/i386/php-imap-4.1.2-7.3.10.legacy.i386.rpm
d01be5026d335032486eee9f91fdc72e43d78f54 
redhat/7.3/updates-testing/i386/php-ldap-4.1.2-7.3.10.legacy.i386.rpm
20ed3b170959f47061fbf688bd0bf6c2380cee6c 
redhat/7.3/updates-testing/i386/php-manual-4.1.2-7.3.10.legacy.i386.rpm
66413adf5bf185326ea1658d837bbd34a4c2e59b 
redhat/7.3/updates-testing/i386/php-mysql-4.1.2-7.3.10.legacy.i386.rpm
5fd105b2b8e9aea72d4e34f4800218b40fe844b9 
redhat/7.3/updates-testing/i386/php-odbc-4.1.2-7.3.10.legacy.i386.rpm
3c9152d075afc06ffb2ac64deeca3b331f3a6c06 
redhat/7.3/updates-testing/i386/php-pgsql-4.1.2-7.3.10.legacy.i386.rpm
58027e3f2bd1485bae158cf99aebc63b631972ec 
redhat/7.3/updates-testing/i386/php-snmp-4.1.2-7.3.10.legacy.i386.rpm
bd2e823603fab8b75a17647ac396263cc1ad6d7e 
redhat/7.3/updates-testing/SRPMS/php-4.1.2-7.3.10.legacy.src.rpm
594a4c87bf2b073b681b1c94a7bcf7ee7d5bc0dd 
redhat/9/updates-testing/i386/php-4.2.2-17.7.legacy.i386.rpm
e1f076f96cfce7d687ad67f26f5e1c33f5993270 
redhat/9/updates-testing/i386/php-devel-4.2.2-17.7.legacy.i386.rpm
d349ace9d0a8514cd563217d56ef1f25261f2c92 
redhat/9/updates-testing/i386/php-imap-4.2.2-17.7.legacy.i386.rpm
176e15f14ec6045aefd9c924dfa383c58598e16d 
redhat/9/updates-testing/i386/php-ldap-4.2.2-17.7.legacy.i386.rpm
a6cda124e7a2de4083bec0a78f6758ab9f36a374 
redhat/9/updates-testing/i386/php-manual-4.2.2-17.7.legacy.i386.rpm
42a87a54e0502721eec4907a8cb1c8db196c442a 
redhat/9/updates-testing/i386/php-mysql-4.2.2-17.7.legacy.i386.rpm
117bc0f478babf8317812fc35c763e8afeccca49 
redhat/9/updates-testing/i386/php-odbc-4.2.2-17.7.legacy.i386.rpm
c52bb318d8b217c02b61bd277f662a483e05e61b 
redhat/9/updates-testing/i386/php-pgsql-4.2.2-17.7.legacy.i386.rpm
6ec57d0958666d97532099d7f1118a52727db02b 
redhat/9/updates-testing/i386/php-snmp-4.2.2-17.7.legacy.i386.rpm
40e6bb2279a9154ecf0c313c39ab563c6de5a8ad 
redhat/9/updates-testing/SRPMS/php-4.2.2-17.7.legacy.src.rpm

---------------------------------------------------------------------

Please test and comment in bugzilla.