Ubuntu 11.10: USN-1307-1 Critical: PHP Image Processing Issue

ubuntu

December 14, 2011

PHP could be made to crash or disclose sensitive information if it processed a specially crafted image file.

Summary

PHP could be made to crash or disclose sensitive information if it

processed a specially crafted image file.

Software Description:

- php5: HTML-embedded scripting language interpreter

Details:

Florent Hochwelker discovered that PHP incorrectly handled certain EXIF

headers in JPEG files. A remote attacker could exploit this issue to

view sensitive information or cause the PHP server to crash.

Topics Covered

security advisory critical ubuntu image processing php flaw

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  php5-cgi                        5.3.6-13ubuntu3.3
  php5-cli                        5.3.6-13ubuntu3.3

Ubuntu 11.04:
  php5-cgi                        5.3.5-1ubuntu7.4
  php5-cli                        5.3.5-1ubuntu7.4

Ubuntu 10.10:
  php5-cgi                        5.3.3-1ubuntu9.7
  php5-cli                        5.3.3-1ubuntu9.7

Ubuntu 10.04 LTS:
  php5-cgi                        5.3.2-1ubuntu4.11
  php5-cli                        5.3.2-1ubuntu4.11

Ubuntu 8.04 LTS:
  php5-cgi                        5.2.4-2ubuntu5.19
  php5-cli                        5.2.4-2ubuntu5.19

In general, a standard system update will make all the necessary changes.