- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 201001-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: High
     Title: PHP: Multiple vulnerabilities
      Date: January 05, 2010
      Bugs: #249875, #255121, #260576, #261192, #266125, #274670,
#280602, #285434, #292132, #293888, #297369, #297370
        ID: 201001-03

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======
Multiple vulnerabilities were found in PHP, the worst of which leading
to the remote execution of arbitrary code.

Background
=========
PHP is a widely-used general-purpose scripting language that is
especially suited for Web development and can be embedded into HTML.

Affected packages
================
    -------------------------------------------------------------------
     Package       /  Vulnerable  /                         Unaffected
    -------------------------------------------------------------------
  1  dev-lang/php      < 5.2.12                              >= 5.2.12

Description
==========
Multiple vulnerabilities have been discovered in PHP. Please review the
CVE identifiers referenced below and the associated PHP release notes
for details.

Impact
=====
A context-dependent attacker could execute arbitrary code via a
specially crafted string containing an HTML entity when the mbstring
extension is enabled. Furthermore a remote attacker could execute
arbitrary code via a specially crafted GD graphics file.

A remote attacker could also cause a Denial of Service via a malformed
string passed to the json_decode() function, via a specially crafted
ZIP file passed to the php_zip_make_relative_path() function, via a
malformed JPEG image passed to the exif_read_data() function, or via
temporary file exhaustion. It is also possible for an attacker to spoof
certificates, bypass various safe_mode and open_basedir restrictions
when certain criteria are met, perform Cross-site scripting attacks,
more easily perform SQL injection attacks, manipulate settings of other
virtual hosts on the same server via a malicious .htaccess entry when
running on Apache, disclose memory portions, and write arbitrary files
via a specially crafted ZIP archive. Some vulnerabilities with unknown
impact and attack vectors have been reported as well.

Workaround
=========
There is no known workaround at this time.

Resolution
=========
All PHP users should upgrade to the latest version. As PHP is
statically linked against a vulnerable version of the c-client library
when the imap or kolab USE flag is enabled (GLSA 200911-03), usersshould upgrade net-libs/c-client beforehand:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-libs/c-client-2007e"
    # emerge --ask --oneshot --verbose ">=dev-lang/php-5.2.12"

References
=========
  [ 1 ] CVE-2008-5498
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5498
  [ 2 ] CVE-2008-5514
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5514
  [ 3 ] CVE-2008-5557
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5557
  [ 4 ] CVE-2008-5624
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5624
  [ 5 ] CVE-2008-5625
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5625
  [ 6 ] CVE-2008-5658
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5658
  [ 7 ] CVE-2008-5814
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5814
  [ 8 ] CVE-2008-5844
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5844
  [ 9 ] CVE-2008-7002
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7002
  [ 10 ] CVE-2009-0754
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0754
  [ 11 ] CVE-2009-1271
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1271
  [ 12 ] CVE-2009-1272
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1272
  [ 13 ] CVE-2009-2626
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2626
  [ 14 ] CVE-2009-2687
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2687
  [ 15 ] CVE-2009-3291
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3291
  [ 16 ] CVE-2009-3292
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3292
  [ 17 ] CVE-2009-3293
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3293
  [ 18 ] CVE-2009-3546
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3546
  [ 19 ] CVE-2009-3557
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3557
  [ 20 ] CVE-2009-3558
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3558
  [ 21 ] CVE-2009-4017
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4017
  [ 22 ] CVE-2009-4142
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4142
  [ 23 ] CVE-2009-4143
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4143
  [ 24 ] GLSA 200911-03
         https://security.gentoo.org/glsa/200911-03

Availability
===========
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  https://security.gentoo.org/glsa/201001-03

Concerns?
========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
======
Copyright 2010 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5/