Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 464
Alerts This Week
Warning Icon 1 464

Slackware 10.2/11.0: 2006-307-01 Critical PHP Buffer Overflow

slackware
Calendar Grey November 4, 2006
Scroller Slackware
Fresh updates for PHP packages made available for Slackware 10.2 and 11.0, targeting vulnerabilities and improving overall performance.
New php packages are available for Slackware 10.2 and 11.0 to fix security issues

Summary

Here are the details from the Slackware 11.0 ChangeLog: extra/php5/php-5.2.0-i486-1.tgz: Upgraded to php-5.2.0. This release "includes a large number of new features, bug fixes and security enhancements." In particular, when the UTF-8 charset is selected there are buffer overflows in the htmlspecialchars() and htmlentities() that may be exploited to execute arbitrary code. More details about the vulnerability may be found here: https://www.cve.org/CVERecord?id=CVE-2006-5465 Further details about the release can be found in the release announcement: https://www.php.net/releases/5_2_0.php Some syntax has changed since PHP 5.1.x. An upgrading guide may be found at this location: https://www.php.net/search.php This package was placed in /extra rather than /patches to save people from possible surprises with automated upgrade tools, since users of PHP4 and PHP 5.1.x applications may need to make some code changes before things will work again. (*

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory buffer overflow php critical threat slackware

Where Find New Packages

HINT: Getting slow download speeds from ftp.slackware.com? Give slackware.osuosl.org a try. This is another primary FTP site for Slackware that can be considerably faster than downloading from ftp.slackware.com.
Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating additional FTP and rsync hosting to the Slackware project! :-)
Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you.
Updated package for Slackware 10.2:
Updated packages for Slackware 11.0:

MD5 Signatures

Slackware 10.2 package: 2c7e99db93c5f4268ab510b72439ec6a php-4.4.4-i486-2_slack10.2.tgz
Slackware 11.0 packages: 9d42f4fd0cb8513ad34fae54be5a7450 php-4.4.4-i486-4_slack11.0.tgz 74a26ae3673b25a88cb7cd162bf37dfa php-5.2.0-i486-1.tgz

Severity
critical
Lowest
Low
Medium
High
Critical

Topics%20covered

Topics Covered

security advisory buffer overflow php critical threat slackware

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Installation Instructions

Installation instructions: Upgrade the packages as root: # upgradepkg php-4.4.4-i486-4_slack11.0.tgz