-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security]  php (SSA:2008-128-01)

New php packages are available for Slackware 10.2, 11.0, 12.0, 12.1,
and -current to fix security issues.

Note that PHP5 is not the default PHP for Slackware 10.2 or 11.0 (those use
PHP4), so if your PHP code is not ready for PHP5, don't upgrade until it is
or you'll (by definition) run into problems.

More details about one of the issues may be found in the Common
Vulnerabilities and Exposures (CVE) database:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0599


Here are the details from the Slackware 12.1 ChangeLog:
+--------------------------+
patches/packages/php-5.2.6-i486-1_slack12.1.tgz:
  Upgraded to php-5.2.6.
  This version of PHP contains many fixes and enhancements.  Some of the fixes
  are security related, and the PHP release announcement provides this list:
    * Fixed possible stack buffer overflow in the FastCGI SAPI identified by
      Andrei Nigmatulin.
    * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
    * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
    * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
    * Properly address incomplete multibyte chars inside escapeshellcmd()
      identified by Stefan Esser.
    * Upgraded bundled PCRE to version 7.6
  When last checked, CVE-2008-0599 was not yet open.  However, additional
  information should become available at this URL:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0599
  The list reproduced above, as well as additional information about other
  fixes in PHP 5.2.6 may be found in the PHP release announcement here:
    https://www.php.net/releases/5_2_6.php
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

HINT:  Getting slow download speeds from ftp.slackware.com?
Give slackware.osuosl.org a try.  This is another primary FTP site
for Slackware that can be considerably faster than downloading
directly from ftp.slackware.com.

Thanks to the friendly folks at the OSU Open Source Lab
(https://osuosl.org/) for donating additional FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on http://www.slackware.com/ for
additional mirror sites near you.

Updated package for Slackware 10.2:
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/testing/packages/php5/php-5.2.6-i486-1_slack10.2.tgz

Updated package for Slackware 11.0:

Updated package for Slackware 12.0:

Updated package for Slackware 12.1:

Updated package for Slackware -current:


MD5 signatures:
+-------------+

Slackware 10.2 package:
4efe7aac0d75ac62b7a81795d026c9b4  php-5.2.6-i486-1_slack10.2.tgz

Slackware 11.0 package:
f34eb2916cac7003750fc56b79d7974b  php-5.2.6-i486-1_slack11.0.tgz

Slackware 12.0 package:
ffca00ec8ce0209e7d9c31c2d922e2fe  php-5.2.6-i486-1_slack12.0.tgz

Slackware 12.1 package:
9b0e03d4a306b64c7b61abd3d3de935d  php-5.2.6-i486-1_slack12.1.tgz

Slackware -current package:
b0ccfaca2876c09ee8359a1b6a012406  php-5.2.6-i486-1.tgz


Installation instructions:
+------------------------+

First, stop Apache:
# apachectl stop

Next, upgrade to the new PHP package:
# upgradepkg php-5.2.6-i486-1_slack12.1.tgz

Finally, restart Apache:
# apachectl start

Or, for Apache 1.3.x versions using SSL:
# apachectl startssl



+-----+