[ubuntu/hardy-security] php5_5.2.4-2ubuntu5.9_hppa_translations.tar.gz, php5_5.2.4-2ubuntu5.9_sparc_translations.tar.gz, php5_5.2.4-2ubuntu5.9_powerpc_translations.tar.gz, php5_5.2.4-2ubuntu5.9_lpia_translations.tar.gz, php5_5.2.4-2ubuntu5.9_amd64_translations.tar.gz, php5_5.2.4-2ubuntu5.9_i386_translations.tar.gz, php5_5.2.4-2ubuntu5.9_ia64_translations.tar.gz, php5 5.2.4-2ubuntu5.9 (Accepted)

[Ubuntu Installer]

php5 (5.2.4-2ubuntu5.9) hardy-security; urgency=low

  * SECURITY UPDATE: file truncation via key with null byte
    - debian/patches/CVE-2008-7068.patch: make sure key and value are sane
      in ext/dba/libinifile/inifile.c.
    - CVE-2008-7068
  * SECURITY UPDATE: certificate spoofing via null-byte certs (LP: #446313)
    - debian/patches/CVE-2009-3291.patch: validate certificate's CN length
      in ext/openssl/openssl.c.
    - CVE-2009-3291
  * SECURITY UPDATE: denial of service via malformed exif images
    (LP: #446313)
    - debian/patches/CVE-2009-3292.patch: check length, return codes, and
      nesting level in ext/exif/exif.c.
    - CVE-2009-3292
  * SECURITY UPDATE: safe_mode bypass via tempam function
    - debian/patches/CVE-2009-3557.patch: check for safe_mode in
      ext/standard/file.c.
    - CVE-2009-3557
  * SECURITY UPDATE: open_basedir restrictions bypass via posix_mkfifo
    - debian/patches/CVE-2009-3558.patch: check for open_basedir in
      ext/posix/posix.c.
    - CVE-2009-3558
  * SECURITY UPDATE: denial of service via large number of files in
    form-data POST request.
    - debian/patches/CVE-2009-4017.patch: introduce new "max_file_uploads"
      directive and enforce in main/main.c, main/rfc1867.c.
    - ATTENTION: this update changes previous php5 behaviour by limiting
      the number of files in a POST request to 50. This may be increased
      by adding a "max_file_uploads" directive to the php.ini configuration
      file.
    - CVE-2009-4017
  * SECURITY UPDATE: safe_mode_protected_env_vars bypass via proc_open()
    - debian/patches/CVE-2009-4018.patch: add safe_mode check in
      ext/standard/proc_open.c
    - CVE-2009-4018

Date: Thu, 26 Nov 2009 08:07:41 -0500
Changed-By: Marc Deslauriers <marc.deslauriers at ubuntu.com>
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/hardy/+source/php5/5.2.4-2ubuntu5.9
-------------- next part --------------
Format: 1.7
Date: Thu, 26 Nov 2009 08:07:41 -0500
Source: php5
Binary: php5 php5-common libapache2-mod-php5 php5-cgi php5-cli php5-dev php-pear php5-curl php5-gd php5-gmp php5-ldap php5-mhash php5-mysql php5-odbc php5-pgsql php5-pspell php5-recode php5-snmp php5-sqlite php5-sybase php5-tidy php5-xmlrpc php5-xsl
Architecture: source
Version: 5.2.4-2ubuntu5.9
Distribution: hardy-security
Urgency: low
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Marc Deslauriers <marc.deslauriers at ubuntu.com>
Description: 
 libapache2-mod-php5 - server-side, HTML-embedded scripting language (apache 2 module)
 php-pear   - PEAR - PHP Extension and Application Repository
 php5       - server-side, HTML-embedded scripting language (meta-package)
 php5-cgi   - server-side, HTML-embedded scripting language (CGI binary)
 php5-cli   - command-line interpreter for the php5 scripting language
 php5-common - Common files for packages built from the php5 source
 php5-curl  - CURL module for php5
 php5-dev   - Files for PHP5 module development
 php5-gd    - GD module for php5
 php5-gmp   - GMP module for php5
 php5-ldap  - LDAP module for php5
 php5-mhash - MHASH module for php5
 php5-mysql - MySQL module for php5
 php5-odbc  - ODBC module for php5
 php5-pgsql - PostgreSQL module for php5
 php5-pspell - pspell module for php5
 php5-recode - recode module for php5
 php5-snmp  - SNMP module for php5
 php5-sqlite - SQLite module for php5
 php5-sybase - Sybase / MS SQL Server module for php5
 php5-tidy  - tidy module for php5
 php5-xmlrpc - XML-RPC module for php5
 php5-xsl   - XSL module for php5
Launchpad-Bugs-Fixed: 446313 446313
Changes: 
 php5 (5.2.4-2ubuntu5.9) hardy-security; urgency=low
 .
   * SECURITY UPDATE: file truncation via key with null byte
     - debian/patches/CVE-2008-7068.patch: make sure key and value are sane
       in ext/dba/libinifile/inifile.c.
     - CVE-2008-7068
   * SECURITY UPDATE: certificate spoofing via null-byte certs (LP: #446313)
     - debian/patches/CVE-2009-3291.patch: validate certificate's CN length
       in ext/openssl/openssl.c.
     - CVE-2009-3291
   * SECURITY UPDATE: denial of service via malformed exif images
     (LP: #446313)
     - debian/patches/CVE-2009-3292.patch: check length, return codes, and
       nesting level in ext/exif/exif.c.
     - CVE-2009-3292
   * SECURITY UPDATE: safe_mode bypass via tempam function
     - debian/patches/CVE-2009-3557.patch: check for safe_mode in
       ext/standard/file.c.
     - CVE-2009-3557
   * SECURITY UPDATE: open_basedir restrictions bypass via posix_mkfifo
     - debian/patches/CVE-2009-3558.patch: check for open_basedir in
       ext/posix/posix.c.
     - CVE-2009-3558
   * SECURITY UPDATE: denial of service via large number of files in
     form-data POST request.
     - debian/patches/CVE-2009-4017.patch: introduce new "max_file_uploads"
       directive and enforce in main/main.c, main/rfc1867.c.
     - ATTENTION: this update changes previous php5 behaviour by limiting
       the number of files in a POST request to 50. This may be increased
       by adding a "max_file_uploads" directive to the php.ini configuration
       file.
     - CVE-2009-4017
   * SECURITY UPDATE: safe_mode_protected_env_vars bypass via proc_open()
     - debian/patches/CVE-2009-4018.patch: add safe_mode check in
       ext/standard/proc_open.c
     - CVE-2009-4018
Files: 
 85359acaf4cd1f6281173b613828a135 1969 web optional php5_5.2.4-2ubuntu5.9.dsc
 e3275142ff44ec01b386598a20e62e7e 152044 web optional php5_5.2.4-2ubuntu5.9.diff.gz
Original-Maintainer: Debian PHP Maintainers <pkg-php-maint at lists.alioth.debian.org>