Oval Definition:	oval:com.redhat.rhsa:def:20050032
Revision Date: 2005-02-15 Version: 502 Title: RHSA-2005:032: php security update (Important) Description: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. Flaws including possible information disclosure, double free, and negative reference index array underflow were found in the deserialization code of PHP. PHP applications may use the unserialize function on untrusted user data, which could allow a remote attacker to gain access to memory or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1019 to this issue. A flaw in the exif extension of PHP was found which lead to a stack overflow. An attacker could create a carefully crafted image file in such a way which, if parsed by a PHP script using the exif extension, could cause a crash or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1065 to this issue. Flaws were found in shmop_write, pack, and unpack PHP functions. These functions are not normally passed user supplied data, so would require a malicious PHP script to be exploited. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1018 to this issue. Users of PHP should upgrade to these updated packages, which contain fixes for these issues. Family: unix Class: patch Status: Reference(s): CVE-2004-1018 CVE-2004-1019 CVE-2004-1065 RHSA-2005:032-01 Platform(s): Red Hat Enterprise Linux 4 Product(s): Definition Synopsis Red Hat Enterprise Linux 4 is installed AND Package Information php-gd is earlier than 0:4.3.9-3.2 AND php-gd is signed with Red Hat master key OR php-odbc is earlier than 0:4.3.9-3.2 AND php-odbc is signed with Red Hat master key OR php-mysql is earlier than 0:4.3.9-3.2 AND php-mysql is signed with Red Hat master key OR php is earlier than 0:4.3.9-3.2 AND php is signed with Red Hat master key OR php-xmlrpc is earlier than 0:4.3.9-3.2 AND php-xmlrpc is signed with Red Hat master key OR php-mbstring is earlier than 0:4.3.9-3.2 AND php-mbstring is signed with Red Hat master key OR php-pgsql is earlier than 0:4.3.9-3.2 AND php-pgsql is signed with Red Hat master key OR php-devel is earlier than 0:4.3.9-3.2 AND php-devel is signed with Red Hat master key OR php-ncurses is earlier than 0:4.3.9-3.2 AND php-ncurses is signed with Red Hat master key OR php-snmp is earlier than 0:4.3.9-3.2 AND php-snmp is signed with Red Hat master key OR php-imap is earlier than 0:4.3.9-3.2 AND php-imap is signed with Red Hat master key OR php-pear is earlier than 0:4.3.9-3.2 AND php-pear is signed with Red Hat master key OR php-domxml is earlier than 0:4.3.9-3.2 AND php-domxml is signed with Red Hat master key OR php-ldap is earlier than 0:4.3.9-3.2 AND php-ldap is signed with Red Hat master key
BACK