Ubuntu 12.04 LTS USN-1481-1 Critical: PHP Several Issues

ubuntu

June 19, 2012

Several security issues were fixed in PHP.

Summary

Several security issues were fixed in PHP.

Software Description:

- php5: HTML-embedded scripting language interpreter

Details:

It was discovered that PHP incorrectly handled certain Tidy::diagnose

operations on invalid objects. A remote attacker could use this flaw to

cause PHP to crash, leading to a denial of service. (CVE-2012-0781)

It was discovered that PHP incorrectly handled certain multi-file upload

filenames. A remote attacker could use this flaw to cause a denial of

service, or to perform a directory traversal attack. (CVE-2012-1172)

Rubin Xu and Joseph Bonneau discovered that PHP incorrectly handled certain

Unicode characters in passwords passed to the crypt() function. A remote

attacker could possibly use this flaw to bypass authentication.

(CVE-2012-2143)

It was discovered that a Debian/Ubuntu specific patch caused PHP to

incorrectly handle empty salt strings. A remote attacker could possibly use

this flaw to bypass authentication. This issu...

Read the Full Advisory

Topics Covered

security advisory denial of service critical php ubuntu authentication bypass

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  php5                            5.3.10-1ubuntu3.2

Ubuntu 11.10:
  php5                            5.3.6-13ubuntu3.8

Ubuntu 11.04:
  php5                            5.3.5-1ubuntu7.10

Ubuntu 10.04 LTS:
  php5                            5.3.2-1ubuntu4.17

Ubuntu 8.04 LTS:
  php5                            5.2.4-2ubuntu5.25

In general, a standard system update will make all the necessary changes.