[ubuntu/karmic-security] php5_5.2.10.dfsg.1-2ubuntu6.3_powerpc_translations.tar.gz, php5_5.2.10.dfsg.1-2ubuntu6.3_ia64_translations.tar.gz, php5_5.2.10.dfsg.1-2ubuntu6.3_armel_translations.tar.gz, php5_5.2.10.dfsg.1-2ubuntu6.3_lpia_translations.tar.gz, php5_5.2.10.dfsg.1-2ubuntu6.3_i386_translations.tar.gz, php5, php5_5.2.10.dfsg.1-2ubuntu6.3_amd64_translations.tar.gz, php5_5.2.10.dfsg.1-2ubuntu6.3_sparc_translations.tar.gz 5.2.10.dfsg.1-2ubuntu6.3 (Accepted)

Ubuntu Installer archive at ubuntu.com
Thu Nov 26 20:03:17 GMT 2009 

php5 (5.2.10.dfsg.1-2ubuntu6.3) karmic-security; urgency=low

  * SECURITY UPDATE: certificate spoofing via null-byte certs (LP: #446313)
    - debian/patches/CVE-2009-3291.patch: validate certificate's CN length
      in ext/openssl/openssl.c.
    - CVE-2009-3291
  * SECURITY UPDATE: denial of service via malformed exif images
    (LP: #446313)
    - debian/patches/CVE-2009-3292.patch: check length, return codes, and
      nesting level in ext/exif/exif.c.
    - CVE-2009-3292
  * SECURITY UPDATE: safe_mode bypass via tempam function
    - debian/patches/CVE-2009-3557.patch: check for safe_mode in
      ext/standard/file.c.
    - CVE-2009-3557
  * SECURITY UPDATE: open_basedir restrictions bypass via posix_mkfifo
    - debian/patches/CVE-2009-3558.patch: check for open_basedir in
      ext/posix/posix.c.
    - CVE-2009-3558
  * SECURITY UPDATE: denial of service via large number of files in
    form-data POST request.
    - debian/patches/CVE-2009-4017.patch: introduce new "max_file_uploads"
      directive and enforce in main/main.c, main/rfc1867.c.
    - ATTENTION: this update changes previous php5 behaviour by limiting
      the number of files in a POST request to 50. This may be increased
      by adding a "max_file_uploads" directive to the php.ini configuration
      file.
    - CVE-2009-4017
  * SECURITY UPDATE: safe_mode_protected_env_vars bypass via proc_open()
    - debian/patches/CVE-2009-4018.patch: add safe_mode check in
      ext/standard/proc_open.c
    - CVE-2009-4018

Date: Thu, 26 Nov 2009 08:27:27 -0500
Changed-By: Marc Deslauriers <marc.deslauriers at ubuntu.com>
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/karmic/+source/php5/5.2.10.dfsg.1-2ubuntu6.3
-------------- next part --------------
Format: 1.8
Date: Thu, 26 Nov 2009 08:27:27 -0500
Source: php5
Binary: php5 php5-common libapache2-mod-php5 libapache2-mod-php5filter php5-cgi php5-cli php5-dev php5-dbg php-pear php5-curl php5-gd php5-gmp php5-ldap php5-mhash php5-mysql php5-odbc php5-pgsql php5-pspell php5-recode php5-snmp php5-sqlite php5-sybase php5-tidy php5-xmlrpc php5-xsl
Architecture: source
Version: 5.2.10.dfsg.1-2ubuntu6.3
Distribution: karmic-security
Urgency: low
Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Marc Deslauriers <marc.deslauriers at ubuntu.com>
Description: 
 libapache2-mod-php5 - server-side, HTML-embedded scripting language (Apache 2 module)
 libapache2-mod-php5filter - server-side, HTML-embedded scripting language (apache 2 filter mo
 php-pear   - PEAR - PHP Extension and Application Repository
 php5       - server-side, HTML-embedded scripting language (metapackage)
 php5-cgi   - server-side, HTML-embedded scripting language (CGI binary)
 php5-cli   - command-line interpreter for the php5 scripting language
 php5-common - Common files for packages built from the php5 source
 php5-curl  - CURL module for php5
 php5-dbg   - Debug symbols for PHP5
 php5-dev   - Files for PHP5 module development
 php5-gd    - GD module for php5
 php5-gmp   - GMP module for php5
 php5-ldap  - LDAP module for php5
 php5-mhash - MHASH module for php5
 php5-mysql - MySQL module for php5
 php5-odbc  - ODBC module for php5
 php5-pgsql - PostgreSQL module for php5
 php5-pspell - pspell module for php5
 php5-recode - recode module for php5
 php5-snmp  - SNMP module for php5
 php5-sqlite - SQLite module for php5
 php5-sybase - Sybase / MS SQL Server module for php5
 php5-tidy  - tidy module for php5
 php5-xmlrpc - XML-RPC module for php5
 php5-xsl   - XSL module for php5
Changes: 
 php5 (5.2.10.dfsg.1-2ubuntu6.3) karmic-security; urgency=low
 .
   * SECURITY UPDATE: certificate spoofing via null-byte certs (LP: #446313)
     - debian/patches/CVE-2009-3291.patch: validate certificate's CN length
       in ext/openssl/openssl.c.
     - CVE-2009-3291
   * SECURITY UPDATE: denial of service via malformed exif images
     (LP: #446313)
     - debian/patches/CVE-2009-3292.patch: check length, return codes, and
       nesting level in ext/exif/exif.c.
     - CVE-2009-3292
   * SECURITY UPDATE: safe_mode bypass via tempam function
     - debian/patches/CVE-2009-3557.patch: check for safe_mode in
       ext/standard/file.c.
     - CVE-2009-3557
   * SECURITY UPDATE: open_basedir restrictions bypass via posix_mkfifo
     - debian/patches/CVE-2009-3558.patch: check for open_basedir in
       ext/posix/posix.c.
     - CVE-2009-3558
   * SECURITY UPDATE: denial of service via large number of files in
     form-data POST request.
     - debian/patches/CVE-2009-4017.patch: introduce new "max_file_uploads"
       directive and enforce in main/main.c, main/rfc1867.c.
     - ATTENTION: this update changes previous php5 behaviour by limiting
       the number of files in a POST request to 50. This may be increased
       by adding a "max_file_uploads" directive to the php.ini configuration
       file.
     - CVE-2009-4017
   * SECURITY UPDATE: safe_mode_protected_env_vars bypass via proc_open()
     - debian/patches/CVE-2009-4018.patch: add safe_mode check in
       ext/standard/proc_open.c
     - CVE-2009-4018
Checksums-Sha1: 
 89131dfe293272039f11a84e607e3029920ed9d5 2529 php5_5.2.10.dfsg.1-2ubuntu6.3.dsc
 672122adca56ef9537c74cb6d2481964f148abdf 957734 php5_5.2.10.dfsg.1-2ubuntu6.3.diff.gz
Checksums-Sha256: 
 503b60887db0a7842c90a2869edb4bff53992f7e1097796c0ae23b332f6b57ab 2529 php5_5.2.10.dfsg.1-2ubuntu6.3.dsc
 8517d2a8b5950dc4bcd12a6392fcd503b4d9253748fb89f4eaf086be96a3032b 957734 php5_5.2.10.dfsg.1-2ubuntu6.3.diff.gz
Files: 
 13f9a8b48f2153c4c41075c9fd8a1e26 2529 php optional php5_5.2.10.dfsg.1-2ubuntu6.3.dsc
 3c0a3fa6c79af30a64b2fd16e5536e69 957734 php optional php5_5.2.10.dfsg.1-2ubuntu6.3.diff.gz
Launchpad-Bugs-Fixed: 446313 446313
Original-Maintainer: Debian PHP Maintainers <pkg-php-maint at lists.alioth.debian.org>

More information about the Karmic-changes mailing list