Paketname
php4
Datum
2009-03-05
Advisory ID
MDVSA-2009:065
Betroffene Versionen
CS4.0 x86_64 , CS4.0 i586

Problembeschreibung

A vulnerability in the cURL library in PHP allowed context-dependent
attackers to bypass safe_mode and open_basedir restrictions and read
arbitrary files using a special URL request (CVE-2007-4850).

improve mbfl_filt_conv_html_dec_flush() error handling in
ext/mbstring/libmbfl/filters/mbfilter_htmlent.c (CVE-2008-5557).

PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows
local users to modify behavior of other sites hosted on the same
web server by modifying the mbstring.func_overload setting within
.htaccess, which causes this setting to be applied to other virtual
hosts on the same server (CVE-2009-0754).

The updated packages have been patched to correct these issues.

Aktualisierte Pakete

CS4.0 x86_64

 8e35646c4b35628a85dd76a8f0473464  corporate/4.0/x86_64/lib64php4_common4-4.4.4-1.10.20060mlcs4.x86_64.rpm
 448245361dff74604f72cbfe3f0273fc  corporate/4.0/x86_64/php4-cgi-4.4.4-1.10.20060mlcs4.x86_64.rpm
 377cc8202704396841dd767975373ac4  corporate/4.0/x86_64/php4-cli-4.4.4-1.10.20060mlcs4.x86_64.rpm
 cc6e7fb2188ab99c9f2fe4ee0ab07bfb  corporate/4.0/x86_64/php4-curl-4.4.4-1.2.20060mlcs4.x86_64.rpm
 98b50b1c01f816a916a24dac82bd45f4  corporate/4.0/x86_64/php4-devel-4.4.4-1.10.20060mlcs4.x86_64.rpm
 c8231e042b861977f9b17ba47b4bb8a7  corporate/4.0/x86_64/php4-mbstring-4.4.4-1.2.20060mlcs4.x86_64.rpm 
 4059cd9721229c87b25b6e4743f13c48  corporate/4.0/SRPMS/php4-4.4.4-1.10.20060mlcs4.src.rpm
 813154bf139d89573632a45437136e73  corporate/4.0/SRPMS/php4-curl-4.4.4-1.2.20060mlcs4.src.rpm
 2df4a7ca570808691586f52452b5601e  corporate/4.0/SRPMS/php4-mbstring-4.4.4-1.2.20060mlcs4.src.rpm

CS4.0 i586

 2dfd22f70a79140151e37ffc650ce562  corporate/4.0/i586/libphp4_common4-4.4.4-1.10.20060mlcs4.i586.rpm
 1e7cfaacc2f0de74932c952002090c7e  corporate/4.0/i586/php4-cgi-4.4.4-1.10.20060mlcs4.i586.rpm
 70891521326ccf379ffcade515c07638  corporate/4.0/i586/php4-cli-4.4.4-1.10.20060mlcs4.i586.rpm
 e040b7271eeecdc71fa3d2bcb7da2bb6  corporate/4.0/i586/php4-curl-4.4.4-1.2.20060mlcs4.i586.rpm
 fe575f3f07a86d419eff519bde3510ea  corporate/4.0/i586/php4-devel-4.4.4-1.10.20060mlcs4.i586.rpm
 16fb016459d51d6455f0c51cd912efdb  corporate/4.0/i586/php4-mbstring-4.4.4-1.2.20060mlcs4.i586.rpm 
 4059cd9721229c87b25b6e4743f13c48  corporate/4.0/SRPMS/php4-4.4.4-1.10.20060mlcs4.src.rpm
 813154bf139d89573632a45437136e73  corporate/4.0/SRPMS/php4-curl-4.4.4-1.2.20060mlcs4.src.rpm
 2df4a7ca570808691586f52452b5601e  corporate/4.0/SRPMS/php4-mbstring-4.4.4-1.2.20060mlcs4.src.rpm

Referenzen