Scientific Linux: CVE-2008-3658 Moderate: php Heap Overflow Exploits

Date: Mon, 6 Apr 2009 16:04:46 -0500
Reply-To: Troy Dawson 
Sender: Security Errata for Scientific Linux
 
From: Troy Dawson 
Subject: Security ERRATA Moderate: php on SL3.x, SL4.x, SL5.x i386/x86_64
Comments: To: "This email address is being protected from spambots. You need JavaScript enabled to view it."
 

Synopsis:	Moderate: php security update
Issue date:	2009-04-06
CVE Names:	CVE-2008-3658 CVE-2008-3660 CVE-2008-5498
 CVE-2008-5557 CVE-2008-5814 CVE-2009-0754

A heap-based buffer overflow flaw was found in PHP's mbstring extension.
A remote attacker able to pass arbitrary input to a PHP script using
mbstring conversion functions could cause the PHP interpreter to crash
or, possibly, execute arbitrary code. (CVE-2008-5557)

A flaw was found in the handling of the "mbstring.func_overload"
configuration setting. A value set for one virtual host, or in a user's
.htaccess file, was incorrectly applied to other virtual hosts on the
same server, causing the handling of multibyte character strings to not
work correctly. (CVE-2009-0754)

A buffer overflow flaw was found in PHP's imageloadfont function. If a
PHP script allowed a remote attacker to load a carefully crafted font
file, it could cause the PHP interpreter to crash or, possibly, execute
arbitrary code. (CVE-2008-3658)

A flaw was found in the way PHP handled certain file extensions when
running in FastCGI mode. If the PHP interpreter was being executed via
FastCGI, a remote attacker could create a request which would cause the
PHP interpreter to crash. (CVE-2008-3660)

A cross-site scripting flaw was found in a way PHP reported errors for
invalid cookies. If the PHP interpreter had "display_errors" enabled, a
remote attacker able to set a specially-crafted cookie on a victim's
system could possibly inject arbitrary HTML into an error message
generated by PHP. (CVE-2008-5814) - SL5 Only

A memory disclosure flaw was found in the PHP gd extension's imagerotate
function. A remote attacker able to pass arbitrary values as the
"background color" argument of the function could, possibly, view
portions of the PHP interpreter's memory. (CVE-2008-5498)

The httpd web server must be restarted for the changes to take effect.

SL 3.0.x

 SRPMS:
php-4.3.2-51.ent.src.rpm
 i386:
php-4.3.2-51.ent.i386.rpm
php-devel-4.3.2-51.ent.i386.rpm
php-imap-4.3.2-51.ent.i386.rpm
php-ldap-4.3.2-51.ent.i386.rpm
php-mysql-4.3.2-51.ent.i386.rpm
php-odbc-4.3.2-51.ent.i386.rpm
php-pgsql-4.3.2-51.ent.i386.rpm
 x86_64:
php-4.3.2-51.ent.x86_64.rpm
php-devel-4.3.2-51.ent.x86_64.rpm
php-imap-4.3.2-51.ent.x86_64.rpm
php-ldap-4.3.2-51.ent.x86_64.rpm
php-mysql-4.3.2-51.ent.x86_64.rpm
php-odbc-4.3.2-51.ent.x86_64.rpm
php-pgsql-4.3.2-51.ent.x86_64.rpm

SL 4.x

 SRPMS:
php-4.3.9-3.22.15.src.rpm
 i386:
php-4.3.9-3.22.15.i386.rpm
php-devel-4.3.9-3.22.15.i386.rpm
php-domxml-4.3.9-3.22.15.i386.rpm
php-gd-4.3.9-3.22.15.i386.rpm
php-imap-4.3.9-3.22.15.i386.rpm
php-ldap-4.3.9-3.22.15.i386.rpm
php-mbstring-4.3.9-3.22.15.i386.rpm
php-mysql-4.3.9-3.22.15.i386.rpm
php-ncurses-4.3.9-3.22.15.i386.rpm
php-odbc-4.3.9-3.22.15.i386.rpm
php-pear-4.3.9-3.22.15.i386.rpm
php-pgsql-4.3.9-3.22.15.i386.rpm
php-snmp-4.3.9-3.22.15.i386.rpm
php-xmlrpc-4.3.9-3.22.15.i386.rpm
 x86_64:
php-4.3.9-3.22.15.x86_64.rpm
php-devel-4.3.9-3.22.15.x86_64.rpm
php-domxml-4.3.9-3.22.15.x86_64.rpm
php-gd-4.3.9-3.22.15.x86_64.rpm
php-imap-4.3.9-3.22.15.x86_64.rpm
php-ldap-4.3.9-3.22.15.x86_64.rpm
php-mbstring-4.3.9-3.22.15.x86_64.rpm
php-mysql-4.3.9-3.22.15.x86_64.rpm
php-ncurses-4.3.9-3.22.15.x86_64.rpm
php-odbc-4.3.9-3.22.15.x86_64.rpm
php-pear-4.3.9-3.22.15.x86_64.rpm
php-pgsql-4.3.9-3.22.15.x86_64.rpm
php-snmp-4.3.9-3.22.15.x86_64.rpm
php-xmlrpc-4.3.9-3.22.15.x86_64.rpm

SL 5.x

 SRPMS:
php-5.1.6-23.2.el5_3.src.rpm
 i386:
php-5.1.6-23.2.el5_3.i386.rpm
php-bcmath-5.1.6-23.2.el5_3.i386.rpm
php-cli-5.1.6-23.2.el5_3.i386.rpm
php-common-5.1.6-23.2.el5_3.i386.rpm
php-dba-5.1.6-23.2.el5_3.i386.rpm
php-devel-5.1.6-23.2.el5_3.i386.rpm
php-gd-5.1.6-23.2.el5_3.i386.rpm
php-imap-5.1.6-23.2.el5_3.i386.rpm
php-ldap-5.1.6-23.2.el5_3.i386.rpm
php-mbstring-5.1.6-23.2.el5_3.i386.rpm
php-mysql-5.1.6-23.2.el5_3.i386.rpm
php-ncurses-5.1.6-23.2.el5_3.i386.rpm
php-odbc-5.1.6-23.2.el5_3.i386.rpm
php-pdo-5.1.6-23.2.el5_3.i386.rpm
php-pgsql-5.1.6-23.2.el5_3.i386.rpm
php-snmp-5.1.6-23.2.el5_3.i386.rpm
php-soap-5.1.6-23.2.el5_3.i386.rpm
php-xml-5.1.6-23.2.el5_3.i386.rpm
php-xmlrpc-5.1.6-23.2.el5_3.i386.rpm
 x86_64:
php-5.1.6-23.2.el5_3.x86_64.rpm
php-bcmath-5.1.6-23.2.el5_3.x86_64.rpm
php-cli-5.1.6-23.2.el5_3.x86_64.rpm
php-common-5.1.6-23.2.el5_3.x86_64.rpm
php-dba-5.1.6-23.2.el5_3.x86_64.rpm
php-devel-5.1.6-23.2.el5_3.x86_64.rpm
php-gd-5.1.6-23.2.el5_3.x86_64.rpm
php-imap-5.1.6-23.2.el5_3.x86_64.rpm
php-ldap-5.1.6-23.2.el5_3.x86_64.rpm
php-mbstring-5.1.6-23.2.el5_3.x86_64.rpm
php-mysql-5.1.6-23.2.el5_3.x86_64.rpm
php-ncurses-5.1.6-23.2.el5_3.x86_64.rpm
php-odbc-5.1.6-23.2.el5_3.x86_64.rpm
php-pdo-5.1.6-23.2.el5_3.x86_64.rpm
php-pgsql-5.1.6-23.2.el5_3.x86_64.rpm
php-snmp-5.1.6-23.2.el5_3.x86_64.rpm
php-soap-5.1.6-23.2.el5_3.x86_64.rpm
php-xml-5.1.6-23.2.el5_3.x86_64.rpm
php-xmlrpc-5.1.6-23.2.el5_3.x86_64.rpm

-Connie Sieh
-Troy Dawson