Fedora Core 2: PHP Code Execution And XSS Risks Advisory

PHP is an HTML-embedded scripting language. PHP attempts to make it

easy for developers to write dynamically generated webpages. PHP also

offers built-in database integration for several commercial and

non-commercial database management systems, so writing a

database-enabled webpage with PHP is fairly simple. The most common

use of PHP coding is probably as a replacement for CGI scripts. The

mod_php module enables the Apache Web server to understand and process

the embedded PHP language in Web pages.

PHP is an HTML-embedded scripting language. PHP attempts to make it

easy for developers to write dynamically generated webpages. PHP also

offers built-in database integration for several commercial and

non-commercial database management systems, so writing a

database-enabled webpage with PHP is fairly simple. The most common

use of PHP coding is probably as a replacement for CGI scripts. The

mod_php module enables the Apache Web server to understand and process

the embedded PHP language in Web pages.

This update includes the latest release of PHP 4, including fixes for security issues in memory limit handling (CVE CAN-2004-0594), and the strip_tags function (CVE CAN-2004-0595). CAN-2004-0595 is not known to be exploitable in the default configuration if using httpd 2.0.50, but can be triggered if the "register_globals" setting has been enabled. CAN-2004-0595 can allow a possible cross-site-scripting attack with some browsers.

The mbstring extension has been moved into the php-mbstring subpackage in this update to reduce the overall package size.

* Fri Jul 16 2004 Joe Orton <jorton@redhat.com> 4.3.8-2.1

- revert upstream default php.ini change since 4.3.6 - add three FD_SETSIZE changes to main/network.c (#125258)

* Wed Jul 14 2004 Joe Orton <jorton@redhat.com> 4.3.8-2.0

- update to 4.3.8 - add gmp_powm fix (Oskari Saarenmaa, #124318) - split out mbstring extension into php-mbstring subpackage - fix rebuild without bison/flex - have -devel require php of same release...