Ubuntu 11.10 USN-1358-1 Moderate: PHP Issues and Security Fix

ubuntu

February 10, 2012

Multiple vulnerabilities in PHP.

Summary

Multiple vulnerabilities in PHP.

Software Description:

- php5: HTML-embedded scripting language interpreter

Details:

It was discovered that PHP computed hash values for form parameterswithout restricting the ability to trigger hash collisions predictably.

This could allow a remote attacker to cause a denial of service by

sending many crafted parameters. (CVE-2011-4885)

ATTENTION: this update changes previous PHP behavior by

limiting the number of external input variables to 1000.

This may be increased by adding a "max_input_vars"

directive to the php.ini configuration file. See

https://www.php.net/manual/en/info.configuration.php more information.

Stefan Esser discovered that the fix to address the predictable hash

collision issue, CVE-2011-4885, did not properly handle the situation

where the limit was reached. This could allow a remote attacker to

cause a denial of service or execute arbitrary code via a request

containing a large number of variables. (CVE-2012-0830)

It was...

Read the Full Advisory

Topics Covered

security advisory moderate denial of service software update code execution php ubuntu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  libapache2-mod-php5             5.3.6-13ubuntu3.5
  php5                            5.3.6-13ubuntu3.5
  php5-cgi                        5.3.6-13ubuntu3.5
  php5-cli                        5.3.6-13ubuntu3.5
  php5-common                     5.3.6-13ubuntu3.5
  php5-xsl                        5.3.6-13ubuntu3.5

Ubuntu 11.04:
  libapache2-mod-php5             5.3.5-1ubuntu7.6
  php5                            5.3.5-1ubuntu7.6
  php5-cgi                        5.3.5-1ubuntu7.6
  php5-cli                        5.3.5-1ubuntu7.6
  php5-common                     5.3.5-1ubuntu7.6
  php5-xsl                        5.3.5-1ubuntu7.6

Ubuntu 10.10:
  libapache2-mod-php5             5.3.3-1ubuntu9.9
  php5                            5.3.3-1ubuntu9.9
  php5-cgi                        5.3.3-1ubuntu9.9
  php5-cli                        5.3.3-1ubuntu9.9
  php5-common                     5.3.3-1ubuntu9.9
  php5-xsl                        5.3.3-1ubuntu9.9

Ubuntu 10.04 LTS:
  libapache2-mod-php5             5.3.2-1ubuntu4.13
  php5                            5.3.2-1ubuntu4.13
  php5-cgi                        5.3.2-1ubuntu4.13
  php5-cli                        5.3.2-1ubuntu4.13
  php5-common                     5.3.2-1ubuntu4.13
  php5-xsl                        5.3.2-1ubuntu4.13

Ubuntu 8.04 LTS:
  libapache2-mod-php5             5.2.4-2ubuntu5.22
  php5                            5.2.4-2ubuntu5.22
  php5-cgi                        5.2.4-2ubuntu5.22
  php5-cli                        5.2.4-2ubuntu5.22
  php5-common                     5.2.4-2ubuntu5.22
  php5-xsl                        5.2.4-2ubuntu5.22

In general, a standard system update will make all the necessary changes.