[SECURITY] [DSA 2492-1] php5 security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2492-1 security@xxxxxxxxxx
http://www.debian.org/security/ Florian Weimer
June 10, 2012 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : php5
Vulnerability : buffer overflow
Problem type : remote
Debian-specific: no
CVE ID : CVE-2012-2386

The Phar extension for PHP does not properly handle crafted tar files,
leading to a heap-based buffer overflow. PHP applications processing
tar files could crash or, potentially, execute arbitrary code.

In addition, this update addresses a regression which caused a crash
when accessing a global object that is returned as $this from __get.

For the stable distribution (squeeze), this problem has been fixed in
version 5.3.3-7+squeeze13.

For the testing distribution (wheezy) and the unstable distribution
(sid), this problem has been fixed in version 5.4.4~rc1-1.

We recommend that you upgrade your php5 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQEcBAEBAgAGBQJP1MvhAAoJEL97/wQC1SS+SwEH/iPdIRQQX3GBnncDDgUnmdpp
oTUhmCBVaAyee2sAX6JDm5/dacwXfQocBDkSD+x5tqeMt7Yfi/8hYfRylDOFyRKP
TQk1EeNm9Sj6Z+O2QjWd3vkBEf2iVbx4DE50PeOQVFIKf2MWRMJHpwiy/Mu/M5bh
67k4WDScT7lvH9qtDI4PPW21Zu/h7st4Kq905qvzr0yqQAtVrqITtvbBQkJ/lOSS
UBE8jWux+ulyUwlIgNzEUfiyNl7Y5oRoTfuYXWXAOyMlIqqyrKB1gm824xRd/WyN
eT97KatpTDSdoickkU4hQvJubxKMd4P+bwgulDoeGb9wvIJsyb1UFibIWAJ7u6g=
=KVPx
-----END PGP SIGNATURE-----

Relevant Pages

  • [Full-disclosure] [SECURITY] [DSA 2492-1] php5 security update
    ... The Phar extension for PHP does not properly handle crafted tar files, ... leading to a heap-based buffer overflow. ... Further information about Debian Security Advisories, ...
    (Full-Disclosure)
  • [Full-disclosure] CVE-2008-5557 - PHP mbstring buffer overflow vulnerability
    ... CVE-2008-5557 - PHP mbstring buffer overflow vulnerability ... 4.3.0 and later versions including PHP 5 ... A heap buffer overflow was found in mbstring extension that is ... The vulnerability occurs in the part of the encoding conversion facility ...
    (Full-Disclosure)
  • Re: Php Fehler mit Libcurl
    ... Mfg Daniel ... Daniel Rafflenbeul: ... PHP-Modul auf eine nicht von Debian installierte Lib zugreifen? ... PHP Warning: PHP Startup: Unable to load dynamic library ...
    (de.comp.lang.php)
  • [SECURITY] [DSA-127-1] buffer overflow in xpilot-server
    ... An internal audit by the xpilot (a multi-player tactical manoeuvring ... game for X) maintainers revealed a buffer overflow in xpilot server. ... Debian GNU/Linux 2.2 alias potato ... Architecture independent archives: ...
    (Bugtraq)
  • Debian: php fast-cgi along with mod_php
    ... I am trying to establish the following scenario using debian squeeze: php using fastcgi/suexec shall be used for regular users which have their home directory under /home/www/. ... Since debian does not allow mod_php to be installed while mpm-worker is installed, I installed mpm-prefork on my testbox as well as mod_php and phpmyadmin. ... Although this question does not perfectly well fit into that group, I am hoping to find apache/php specialists here since all the available apache groups seem to be ghosts towns by now. ...
    (comp.lang.php)