Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 465
Alerts This Week
Warning Icon 1 465

Slackware 10.2: 2006-217-01 Critical Update for PHP Buffer Overflow

slackware
Calendar Grey August 5, 2006
Scroller Slackware
Recent updates to PHP packages on Slackware address critical security vulnerabilities such as buffer overflow threats and cross-site scripting (XSS) weaknesses.
New php packages are available for Slackware 10.2 and -current to fix security and other issues

Summary

Here are the details from the Slackware 10.2 ChangeLog: patches/packages/php-4.4.3-i486-1_slack10.2.tgz: Upgraded to php-4.4.3. From the announcement of the release: The security issues resolved include the following: * Disallow certain characters in session names. * Fixed a buffer overflow inside the wordwrap() function. * Prevent jumps to parent directory via the 2nd parameter of the tempnam() function. * Improved safe_mode check for the error_log() function. * Fixed cross-site scripting inside the phpinfo() function. The PHP 4.4.3 release announcement may be found on their web site: https://www.php.net/ (* Security fix *)

Where Find New Packages

Updated package for Slackware 10.2:
Updated package for Slackware -current:

MD5 Signatures

Slackware 10.2 package: 417d976f97a53240868e5c715f1ba00b php-4.4.3-i486-1_slack10.2.tgz
Slackware -current package: 713b87c55978e85275c27e720c595ef4 php-4.4.3-i486-1.tgz

Severity
critical
Lowest
Low
Medium
High
Critical

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Installation Instructions

Installation instructions: Upgrade the package as root: # upgradepkg php-4.4.3-i486-1_slack10.2.tgz