Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 4 articles for you...
89
security advisoryfedoraupdateFedora 29: FEDORA-2019-af7bef7165 Moderate: Handling php-typo3-phar-stream
## php-typo3-phar-stream-wrapper2 ### v2.1.2 Handling mime-type & Windows paths #### Resolved Issues - \#34: Normalize resolved Windows path to Unix-style - \#42: Avoid analysing non-phar files on alias resolving - \#40: Add Windows tests using AppVeyor - \#33: Add alternative mime-type resolving (without ext- fileinfo) ### v2.1.1 Phar Alias Handling & Performance Releases v3.1.1 and. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-af7bef7165 2019-06-28 05:20:24.267217 --------------------------------------------------------------------------------Name : php-typo3-phar-stream-wrapper2 Product : Fedora 29 Version : 2.1.2 Release : 1.fc29 URL : https://github.com/TYPO3/phar-stream-wrapper Summary : Interceptors for PHP's native phar:// stream handling (v2) Description : Interceptors for PHP's native phar:// stream handling (v2). Autoloader: /usr/share/php/TYPO3/PharStreamWrapper2/autoload.php --------------------------------------------------------------------------------Update Information: ## php-typo3-phar-stream-wrapper2 ### v2.1.2 Handling mime-type & Windows paths #### Resolved Issues - \#34: Normalize resolved Windows path to Unix-style -\#42: Avoid analysing non-phar files on alias resolving - \#40: Add Windows tests using AppVeyor - \#33: Add alternative mime-type resolving (without ext-fileinfo) ### v2.1.1 Phar Alias Handling & Performance Releases v3.1.1 and v.2.1.1 aim to overcome drawbacks in Phar's alias resolving from Phar stub as well as solving performance aspects. ### v2.1.0 Phar Alias Handling #### Description Releases v3.1.0 and v.2.1.0 aim to overcome drawbacks in Phar's alias resolving (either by Phar archives using `Phar::setAlias()` in meta-data or `Phar::mapPhar()` in stub code). Merged pull-requests - Phar alias resolving (v3: #10, #12, v2: #14, #15) - Phar alias handling and (v3: #16, #17, v2: #20) #### Migration In case custom Assertableinterceptors have been used, path resolving has to be adjusted in order to make use of alias resolving features. ##### before - example in v3.0.1 $baseFile Helper::determineBaseFile($path); ##### after - example in v3.1.0 $invocation = Manager::instance()-> resolve($path); $baseName $invocation-> getBaseName(); // previously called $baseFile #### Open Issues There have been reports about flaws using `stream_select()` and according `stream_cast()` in `PharStreamWrapper`. Since it was not possible to reproduce the behavior in an isolated scenario and specific platform requiresments were not clear, these aspects have not been covered by these releses - see #8 and #19 for details. #### Features - added low-level `Phar\Reader` for stub & meta-data (incl. alias) and their model representations - added `Resolver\PharInvocationResolver` in order to resolve/handle alias names - added `Interceptor\ConjunctionInterceptor` for combining multiple interceptors - added `Interceptor\PharMetaDataInterceptor` for actually testing against insecure deserialization in meta-data of Phar archives ## php-brumann-polyfill-unserialize Backports unserialize options introduced in PHP 7.0 to older PHP versions. This was originally designed as a Proof of Concept for Symfony Issue [#21090](https://github.com/symfony/symfony/pull/21090). You can use this package in projects that rely on PHP versions older than PHP 7.0. In case you are using PHP 7.0+ the original unserialize() will be used instead. From the [documentation](https://www.php.net/manual/en/function.unserialize.php): > Warning: Do not pass untrusted user input to unserialize(). Unserialization > can result in code being loaded and executed due to object instantiation and > autoloading, and a malicious user may be able to exploit this. This warning holds true even when `allowed_classes` is used. --------------------------------------------------------------------------------References: [ 1 ] Bug #1708649 - CVE-2019-11831phar-stream-wrapper: TYP03 does not prevent directory traversal resulting in bypass of deserialization of protection mechanism https://bugzilla.redhat.com/show_bug.cgi?id=1708649 [ 2 ] Bug #1708646 - CVE-2019-11830 phar-stream-wrapper: mishandling of phar stub parsing leads to bypass a deserialization of protection mechanism https://bugzilla.redhat.com/show_bug.cgi?id=1708646 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-af7bef7165' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Jun 28, 2019
Fedora
99
security advisorysecurity issuesoftware upgradeSlackware: 2016:203-02 Critical: PHP Update for Security Issues
New php packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] php (SSA:2016-203-02) New php packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: +--------------------------+ patches/packages/php-5.6.24-i586-1_slack14.2.txz: Upgraded. This release fixes bugs and security issues. For more information, see: https://www.php.net/ChangeLog-5.php https://www.cve.org/CVERecord?id=CVE-2016-5385 https://www.cve.org/CVERecord?id=CVE-2016-6207 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you. Updated package for Slackware 14.0: Updated package for Slackware x86_64 14.0: Updated package for Slackware 14.1: Updated package for Slackware x86_64 14.1: Updated package for Slackware 14.2: Updated package for Slackware x86_64 14.2: Updated package for Slackware -current: Updated package for Slackware x86_64 -current: MD5 signatures: +-------------+ Slackware 14.0 package: 712cc177c9ac10f3d58e871ff27260dc php-5.6.24-i486-1_slack14.0.txz Slackware x86_64 14.0 package: 47f6ad4a81517f5b2959abc73475742b php-5.6.24-x86_64-1_slack14.0.txz Slackware 14.1 package: aea6a8869946186781e55c5ecec952b0 php-5.6.24-i486-1_slack14.1.txz Slackware x86_64 14.1 package: ab16db742762605b9b219b37cdd7e8db php-5.6.24-x86_64-1_slack14.1.txz Slackware 14.2 package: c88a731667e741443712267d9b30286a php-5.6.24-i586-1_slack14.2.txz Slackware x86_64 14.2 package: ed5b31c94e2fb91f0e6c40051f51da1c php-5.6.24-x86_64-1_slack14.2.txz Slackware -current package: c25a85fece34101d35b8785022cef94d n/php-5.6.24-i586-1.txz Slackware x86_64 -current package: 17f8886fc0901cea6d593170ea00fe7b n/php-5.6.24-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg php-5.6.24-i586-1_slack14.2.txz Then, restart Apache httpd: # /etc/rc.d/rc.httpd stop # /etc/rc.d/rc.httpd start +-----+ . The latest PHP packages targeting security vulnerabilities have been released for various Slackware variants. Discover the steps to perform the upgrade.. php Packages, Slackware Security, Package Management, Security Issues, Upgrade Instructions. . Severity: Critical. LinuxSecurity.com Team
Jul 21, 2016
•Critical
Slackware
89
security advisoryfedoracriticalFedora 22: 2015-15203 Critical Issue in Php-Doctrine-Annotations Config
CVE-2015-5723 https://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2015-15203 2015-09-14 18:16:15.199548 -------------------------------------------------------------------------------- Name : php-doctrine-annotations Product : Fedora 22 Version : 1.2.7 Release : 1.fc22 URL : https://github.com/doctrine/annotations Summary : PHP docblock annotations parser library Description : PHP docblock annotations parser library (extracted from Doctrine Common). -------------------------------------------------------------------------------- Update Information: CVE-2015-5723 https://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html -------------------------------------------------------------------------------- References: [ 1 ] Bug #1258669 - php-doctrine-annotations-v1.2.7 is available https://bugzilla.redhat.com/show_bug.cgi?id=1258669 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update php-doctrine-annotations' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list
Sep 14, 2015
•Critical
Fedora
99
security advisorycriticalsoftware updateSlackware 14.1 Advisory SSA:2015-162-02 Critical: Php Package Security Fix
New php packages are available for Slackware 14.0, 14.1, and -current to fix security issues. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] php (SSA:2015-162-02) New php packages are available for Slackware 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: +--------------------------+ patches/packages/php-5.4.41-i486-1_slack14.1.txz: Upgraded. This update fixes some bugs and security issues. For more information, see: https://www.cve.org/CVERecord?id=CVE-2006-7243 https://www.cve.org/CVERecord?id=CVE-2015-2325 https://www.cve.org/CVERecord?id=CVE-2015-2326 https://www.cve.org/CVERecord?id=CVE-2015-4021 https://www.cve.org/CVERecord?id=CVE-2015-4022 https://www.cve.org/CVERecord?id=CVE-2015-4024 https://www.cve.org/CVERecord?id=CVE-2015-4025 https://www.cve.org/CVERecord?id=CVE-2015-4026 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you. Updated package for Slackware 14.0: Updated package for Slackware x86_64 14.0: Updated package for Slackware 14.1: Updated package for Slackware x86_64 14.1: Updated package for Slackware -current: Updated package for Slackware x86_64 -current: MD5 signatures: +-------------+ Slackware 14.0 package: 5e8d107dba11f8c87693edfdc32f56b7 php-5.4.41-i486-1_slack14.0.txz Slackware x86_64 14.0 package: 24d6895fe6b0e9c88b04ceaccc35383d php-5.4.41-x86_64-1_slack14.0.txz Slackware 14.1 package: 52011eec3a256a365789562b63e8ba84 php-5.4.41-i486-1_slack14.1.txz Slackware x86_64 14.1 package: 82b75af6253121cab6cc84dd714f554c php-5.4.41-x86_64-1_slack14.1.txz Slackware -current package: e1c64f133f44b0abac21e0846e39d3c8 n/php-5.6.9-i586-1.txz Slackwarex86_64 -current package: ae51c99af34a4bd8721e7140c38a8c1a n/php-5.6.9-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg php-5.4.41-i486-1_slack14.1.txz Then, restart Apache httpd: # /etc/rc.d/rc.httpd stop # /etc/rc.d/rc.httpd start +-----+ . Updated software modules have been released for Slackware 14.0 and 14.1 to resolve significant vulnerabilities and improve overall system security.. Slackware php update, php security fix, security advisory, software update. . Severity: Critical. LinuxSecurity.com Team
Jun 11, 2015
•Critical
Slackware
99
security advisorysecurity issuesoftware updateSlackware 14.0, 14.1 Security Advisory: PHP Segfault And CPU Issue
New php packages are available for Slackware 14.0, 14.1, and -current to fix a security issue. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] php (SSA:2014-074-01) New php packages are available for Slackware 14.0, 14.1, and -current to fix a security issue. Here are the details from the Slackware 14.1 ChangeLog: +--------------------------+ patches/packages/php-5.4.26-i486-1_slack14.1.txz: Upgraded. This update fixes a flaw where a specially crafted data file may cause a segfault or 100% CPU consumption when a web page uses fileinfo() on it. For more information, see: https://www.cve.org/CVERecord?id=CVE-2014-1943 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you. Updated package for Slackware 14.0: Updated package for Slackware x86_64 14.0: Updated package for Slackware 14.1: Updated package for Slackware x86_64 14.1: Updated package for Slackware -current: Updated package for Slackware x86_64 -current: MD5 signatures: +-------------+ Slackware 14.0 package: 1c864df50286602ccb2d3efbabb9d7ec php-5.4.24-i486-1_slack14.0.txz Slackware x86_64 14.0 package: cc0f365855b83708c82a84ea44a4ad21 php-5.4.24-x86_64-1_slack14.0.txz Slackware 14.1 package: 1091912280ef2fbe271da2aa304dba36 php-5.4.24-i486-1_slack14.1.txz Slackware x86_64 14.1 package: 22b91ef0428a15b3124c5b4fb911b1bc php-5.4.24-x86_64-1_slack14.1.txz Slackware -current package: 41157dbaae1a9c3c7b0aa82abbbb9d5c n/php-5.4.26-i486-1.txz Slackware x86_64 -current package: ef27596b3bbf2eba8f6c66092e8b9d21 n/php-5.4.26-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg php-5.4.24-i486-1_slack14.1.txz Then, restart Apache httpd: #/etc/rc.d/rc.httpd stop # /etc/rc.d/rc.httpd start +-----+ . Recent updates for PHP packages address a segfault or performance problem in Slackware. Users are advised to upgrade for versions 14.0 and 14.1.. PHP Security Update, Slackware Packages, Software Installation. . Severity: Critical. LinuxSecurity.com Team
Mar 16, 2014
•Critical
Slackware
98
security advisorysecurity issueRed HatRed Hat Enterprise Linux 6: RHSA-2013:0514-02 Moderate: PHP Fixes
Updated php packages that fix three security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: php security, bug fix and enhancement update Advisory ID: RHSA-2013:0514-02 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2013:0514.html Issue date: 2013-02-21 CVE Names: CVE-2011-1398 CVE-2012-0831 CVE-2012-2688 ==================================================================== 1. Summary: Updated php packages that fix three security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 3. Description: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that PHP did not check for carriage returns in HTTP headers, allowing intended HTTP response splitting protections to be bypassed. Depending on the web browser thevictim is using, a remote attacker could use this flaw to perform HTTP response splitting attacks. (CVE-2011-1398) An integer signedness issue, leading to a heap-based buffer underflow, was found in the PHP scandir() function. If a remote attacker could upload an excessively large number of files to a directory the scandir() function runs on, it could cause the PHP interpreter to crash or, possibly, execute arbitrary code. (CVE-2012-2688) It was found that PHP did not correctly handle the magic_quotes_gpc configuration directive. This could result in magic_quotes_gpc input escaping not being applied in all cases, possibly making it easier for a remote attacker to perform SQL injection attacks. (CVE-2012-0831) These updated php packages also include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.4 Technical Notes, linked to in the References, for information on the most significant of these changes. All users of php are advised to upgrade to these updated packages, which fix these issues and add these enhancements. After installing the updated packages, the httpd daemon must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 771738 - var_export on negative array indexes returns unsigned index id 789468 - CVE-2012-0831 php: PG(magic_quote_gpc) was not restored on shutdown 812819 - setDate, setISODate, setTime works wrong when DateTime created from timestamp 824199 - PDOStatement execute segfaults for pdo_mysql driver 824293 - Include php-fpm in php build 828051 - CVE-2012-2688 php: Integer Signedness issues in _php_stream_scandir 833545 - dependencies onphp-common are not arch-specific. 837042 - add php(language) virtual provide 853329 - CVE-2011-1398 PHP: sapi_header_op() %0D sequence handling security bypass 858653 - fileinfo extension: use stat function from stream wrapper 868375 - $this becomes a non-object 874987 - Missing provides in php-xml 6. Package List: Red Hat Enterprise Linux Desktop Optional (v.6): Source: i386: php-5.3.3-22.el6.i686.rpm php-bcmath-5.3.3-22.el6.i686.rpm php-cli-5.3.3-22.el6.i686.rpm php-common-5.3.3-22.el6.i686.rpm php-dba-5.3.3-22.el6.i686.rpm php-debuginfo-5.3.3-22.el6.i686.rpm php-devel-5.3.3-22.el6.i686.rpm php-embedded-5.3.3-22.el6.i686.rpm php-enchant-5.3.3-22.el6.i686.rpm php-fpm-5.3.3-22.el6.i686.rpm php-gd-5.3.3-22.el6.i686.rpm php-imap-5.3.3-22.el6.i686.rpm php-intl-5.3.3-22.el6.i686.rpm php-ldap-5.3.3-22.el6.i686.rpm php-mbstring-5.3.3-22.el6.i686.rpm php-mysql-5.3.3-22.el6.i686.rpm php-odbc-5.3.3-22.el6.i686.rpm php-pdo-5.3.3-22.el6.i686.rpm php-pgsql-5.3.3-22.el6.i686.rpm php-process-5.3.3-22.el6.i686.rpm php-pspell-5.3.3-22.el6.i686.rpm php-recode-5.3.3-22.el6.i686.rpm php-snmp-5.3.3-22.el6.i686.rpm php-soap-5.3.3-22.el6.i686.rpm php-tidy-5.3.3-22.el6.i686.rpm php-xml-5.3.3-22.el6.i686.rpm php-xmlrpc-5.3.3-22.el6.i686.rpm php-zts-5.3.3-22.el6.i686.rpm x86_64: php-5.3.3-22.el6.x86_64.rpm php-bcmath-5.3.3-22.el6.x86_64.rpm php-cli-5.3.3-22.el6.x86_64.rpm php-common-5.3.3-22.el6.x86_64.rpm php-dba-5.3.3-22.el6.x86_64.rpm php-debuginfo-5.3.3-22.el6.x86_64.rpm php-devel-5.3.3-22.el6.x86_64.rpm php-embedded-5.3.3-22.el6.x86_64.rpm php-enchant-5.3.3-22.el6.x86_64.rpm php-fpm-5.3.3-22.el6.x86_64.rpm php-gd-5.3.3-22.el6.x86_64.rpm php-imap-5.3.3-22.el6.x86_64.rpm php-intl-5.3.3-22.el6.x86_64.rpm php-ldap-5.3.3-22.el6.x86_64.rpm php-mbstring-5.3.3-22.el6.x86_64.rpm php-mysql-5.3.3-22.el6.x86_64.rpm php-odbc-5.3.3-22.el6.x86_64.rpm php-pdo-5.3.3-22.el6.x86_64.rpm php-pgsql-5.3.3-22.el6.x86_64.rpm php-process-5.3.3-22.el6.x86_64.rpm php-pspell-5.3.3-22.el6.x86_64.rpm php-recode-5.3.3-22.el6.x86_64.rpm php-snmp-5.3.3-22.el6.x86_64.rpm php-soap-5.3.3-22.el6.x86_64.rpm php-tidy-5.3.3-22.el6.x86_64.rpm php-xml-5.3.3-22.el6.x86_64.rpm php-xmlrpc-5.3.3-22.el6.x86_64.rpm php-zts-5.3.3-22.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: x86_64: php-cli-5.3.3-22.el6.x86_64.rpm php-common-5.3.3-22.el6.x86_64.rpm php-debuginfo-5.3.3-22.el6.x86_64.rpm Red Hat EnterpriseLinux HPC Node Optional (v. 6): Source: x86_64: php-5.3.3-22.el6.x86_64.rpm php-bcmath-5.3.3-22.el6.x86_64.rpm php-dba-5.3.3-22.el6.x86_64.rpm php-debuginfo-5.3.3-22.el6.x86_64.rpm php-devel-5.3.3-22.el6.x86_64.rpm php-embedded-5.3.3-22.el6.x86_64.rpm php-enchant-5.3.3-22.el6.x86_64.rpm php-fpm-5.3.3-22.el6.x86_64.rpm php-gd-5.3.3-22.el6.x86_64.rpm php-imap-5.3.3-22.el6.x86_64.rpm php-intl-5.3.3-22.el6.x86_64.rpm php-ldap-5.3.3-22.el6.x86_64.rpm php-mbstring-5.3.3-22.el6.x86_64.rpm php-mysql-5.3.3-22.el6.x86_64.rpm php-odbc-5.3.3-22.el6.x86_64.rpm php-pdo-5.3.3-22.el6.x86_64.rpm php-pgsql-5.3.3-22.el6.x86_64.rpm php-process-5.3.3-22.el6.x86_64.rpm php-pspell-5.3.3-22.el6.x86_64.rpm php-recode-5.3.3-22.el6.x86_64.rpm php-snmp-5.3.3-22.el6.x86_64.rpm php-soap-5.3.3-22.el6.x86_64.rpm php-tidy-5.3.3-22.el6.x86_64.rpm php-xml-5.3.3-22.el6.x86_64.rpm php-xmlrpc-5.3.3-22.el6.x86_64.rpm php-zts-5.3.3-22.el6.x86_64.rpm Red Hat Enterprise Linux Server (v.6): Source: i386: php-5.3.3-22.el6.i686.rpm php-cli-5.3.3-22.el6.i686.rpm php-common-5.3.3-22.el6.i686.rpm php-debuginfo-5.3.3-22.el6.i686.rpm php-gd-5.3.3-22.el6.i686.rpm php-ldap-5.3.3-22.el6.i686.rpm php-mysql-5.3.3-22.el6.i686.rpm php-odbc-5.3.3-22.el6.i686.rpm php-pdo-5.3.3-22.el6.i686.rpm php-pgsql-5.3.3-22.el6.i686.rpm php-soap-5.3.3-22.el6.i686.rpm php-xml-5.3.3-22.el6.i686.rpm php-xmlrpc-5.3.3-22.el6.i686.rpm ppc64: php-5.3.3-22.el6.ppc64.rpm php-cli-5.3.3-22.el6.ppc64.rpm php-common-5.3.3-22.el6.ppc64.rpm php-debuginfo-5.3.3-22.el6.ppc64.rpm php-gd-5.3.3-22.el6.ppc64.rpm php-ldap-5.3.3-22.el6.ppc64.rpm php-mysql-5.3.3-22.el6.ppc64.rpm php-odbc-5.3.3-22.el6.ppc64.rpm php-pdo-5.3.3-22.el6.ppc64.rpm php-pgsql-5.3.3-22.el6.ppc64.rpm php-soap-5.3.3-22.el6.ppc64.rpm php-xml-5.3.3-22.el6.ppc64.rpm php-xmlrpc-5.3.3-22.el6.ppc64.rpm s390x: php-5.3.3-22.el6.s390x.rpm php-cli-5.3.3-22.el6.s390x.rpm php-common-5.3.3-22.el6.s390x.rpm php-debuginfo-5.3.3-22.el6.s390x.rpm php-gd-5.3.3-22.el6.s390x.rpm php-ldap-5.3.3-22.el6.s390x.rpm php-mysql-5.3.3-22.el6.s390x.rpm php-odbc-5.3.3-22.el6.s390x.rpm php-pdo-5.3.3-22.el6.s390x.rpm php-pgsql-5.3.3-22.el6.s390x.rpm php-soap-5.3.3-22.el6.s390x.rpm php-xml-5.3.3-22.el6.s390x.rpm php-xmlrpc-5.3.3-22.el6.s390x.rpm x86_64: php-5.3.3-22.el6.x86_64.rpm php-cli-5.3.3-22.el6.x86_64.rpm php-common-5.3.3-22.el6.x86_64.rpm php-debuginfo-5.3.3-22.el6.x86_64.rpm php-gd-5.3.3-22.el6.x86_64.rpm php-ldap-5.3.3-22.el6.x86_64.rpm php-mysql-5.3.3-22.el6.x86_64.rpm php-odbc-5.3.3-22.el6.x86_64.rpm php-pdo-5.3.3-22.el6.x86_64.rpm php-pgsql-5.3.3-22.el6.x86_64.rpm php-soap-5.3.3-22.el6.x86_64.rpm php-xml-5.3.3-22.el6.x86_64.rpm php-xmlrpc-5.3.3-22.el6.x86_64.rpm Red Hat Enterprise Linux Server Optional (v.6): Source: i386: php-bcmath-5.3.3-22.el6.i686.rpm php-dba-5.3.3-22.el6.i686.rpm php-debuginfo-5.3.3-22.el6.i686.rpm php-devel-5.3.3-22.el6.i686.rpm php-embedded-5.3.3-22.el6.i686.rpm php-enchant-5.3.3-22.el6.i686.rpm php-fpm-5.3.3-22.el6.i686.rpm php-imap-5.3.3-22.el6.i686.rpm php-intl-5.3.3-22.el6.i686.rpm php-mbstring-5.3.3-22.el6.i686.rpm php-process-5.3.3-22.el6.i686.rpm php-pspell-5.3.3-22.el6.i686.rpm php-recode-5.3.3-22.el6.i686.rpm php-snmp-5.3.3-22.el6.i686.rpm php-tidy-5.3.3-22.el6.i686.rpm php-zts-5.3.3-22.el6.i686.rpm ppc64: php-bcmath-5.3.3-22.el6.ppc64.rpm php-dba-5.3.3-22.el6.ppc64.rpm php-debuginfo-5.3.3-22.el6.ppc64.rpm php-devel-5.3.3-22.el6.ppc64.rpm php-embedded-5.3.3-22.el6.ppc64.rpm php-enchant-5.3.3-22.el6.ppc64.rpm php-fpm-5.3.3-22.el6.ppc64.rpm php-imap-5.3.3-22.el6.ppc64.rpm php-intl-5.3.3-22.el6.ppc64.rpm php-mbstring-5.3.3-22.el6.ppc64.rpm php-process-5.3.3-22.el6.ppc64.rpm php-pspell-5.3.3-22.el6.ppc64.rpm php-recode-5.3.3-22.el6.ppc64.rpm php-snmp-5.3.3-22.el6.ppc64.rpm php-tidy-5.3.3-22.el6.ppc64.rpm php-zts-5.3.3-22.el6.ppc64.rpm s390x: php-bcmath-5.3.3-22.el6.s390x.rpm php-dba-5.3.3-22.el6.s390x.rpm php-debuginfo-5.3.3-22.el6.s390x.rpm php-devel-5.3.3-22.el6.s390x.rpm php-embedded-5.3.3-22.el6.s390x.rpm php-enchant-5.3.3-22.el6.s390x.rpm php-fpm-5.3.3-22.el6.s390x.rpm php-imap-5.3.3-22.el6.s390x.rpm php-intl-5.3.3-22.el6.s390x.rpm php-mbstring-5.3.3-22.el6.s390x.rpm php-process-5.3.3-22.el6.s390x.rpm php-pspell-5.3.3-22.el6.s390x.rpm php-recode-5.3.3-22.el6.s390x.rpm php-snmp-5.3.3-22.el6.s390x.rpm php-tidy-5.3.3-22.el6.s390x.rpm php-zts-5.3.3-22.el6.s390x.rpm x86_64: php-bcmath-5.3.3-22.el6.x86_64.rpm php-dba-5.3.3-22.el6.x86_64.rpm php-debuginfo-5.3.3-22.el6.x86_64.rpm php-devel-5.3.3-22.el6.x86_64.rpm php-embedded-5.3.3-22.el6.x86_64.rpm php-enchant-5.3.3-22.el6.x86_64.rpm php-fpm-5.3.3-22.el6.x86_64.rpm php-imap-5.3.3-22.el6.x86_64.rpm php-intl-5.3.3-22.el6.x86_64.rpm php-mbstring-5.3.3-22.el6.x86_64.rpm php-process-5.3.3-22.el6.x86_64.rpm php-pspell-5.3.3-22.el6.x86_64.rpm php-recode-5.3.3-22.el6.x86_64.rpm php-snmp-5.3.3-22.el6.x86_64.rpm php-tidy-5.3.3-22.el6.x86_64.rpm php-zts-5.3.3-22.el6.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: i386: php-5.3.3-22.el6.i686.rpm php-cli-5.3.3-22.el6.i686.rpm php-common-5.3.3-22.el6.i686.rpm php-debuginfo-5.3.3-22.el6.i686.rpm php-gd-5.3.3-22.el6.i686.rpm php-ldap-5.3.3-22.el6.i686.rpm php-mysql-5.3.3-22.el6.i686.rpm php-odbc-5.3.3-22.el6.i686.rpm php-pdo-5.3.3-22.el6.i686.rpm php-pgsql-5.3.3-22.el6.i686.rpm php-soap-5.3.3-22.el6.i686.rpm php-xml-5.3.3-22.el6.i686.rpm php-xmlrpc-5.3.3-22.el6.i686.rpm x86_64: php-5.3.3-22.el6.x86_64.rpm php-cli-5.3.3-22.el6.x86_64.rpm php-common-5.3.3-22.el6.x86_64.rpm php-debuginfo-5.3.3-22.el6.x86_64.rpm php-gd-5.3.3-22.el6.x86_64.rpm php-ldap-5.3.3-22.el6.x86_64.rpm php-mysql-5.3.3-22.el6.x86_64.rpm php-odbc-5.3.3-22.el6.x86_64.rpm php-pdo-5.3.3-22.el6.x86_64.rpm php-pgsql-5.3.3-22.el6.x86_64.rpm php-soap-5.3.3-22.el6.x86_64.rpm php-xml-5.3.3-22.el6.x86_64.rpm php-xmlrpc-5.3.3-22.el6.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v.6): Source: i386: php-bcmath-5.3.3-22.el6.i686.rpm php-dba-5.3.3-22.el6.i686.rpm php-debuginfo-5.3.3-22.el6.i686.rpm php-devel-5.3.3-22.el6.i686.rpm php-embedded-5.3.3-22.el6.i686.rpm php-enchant-5.3.3-22.el6.i686.rpm php-fpm-5.3.3-22.el6.i686.rpm php-imap-5.3.3-22.el6.i686.rpm php-intl-5.3.3-22.el6.i686.rpm php-mbstring-5.3.3-22.el6.i686.rpm php-process-5.3.3-22.el6.i686.rpm php-pspell-5.3.3-22.el6.i686.rpm php-recode-5.3.3-22.el6.i686.rpm php-snmp-5.3.3-22.el6.i686.rpm php-tidy-5.3.3-22.el6.i686.rpm php-zts-5.3.3-22.el6.i686.rpm x86_64: php-bcmath-5.3.3-22.el6.x86_64.rpm php-dba-5.3.3-22.el6.x86_64.rpm php-debuginfo-5.3.3-22.el6.x86_64.rpm php-devel-5.3.3-22.el6.x86_64.rpm php-embedded-5.3.3-22.el6.x86_64.rpm php-enchant-5.3.3-22.el6.x86_64.rpm php-fpm-5.3.3-22.el6.x86_64.rpm php-imap-5.3.3-22.el6.x86_64.rpm php-intl-5.3.3-22.el6.x86_64.rpm php-mbstring-5.3.3-22.el6.x86_64.rpm php-process-5.3.3-22.el6.x86_64.rpm php-pspell-5.3.3-22.el6.x86_64.rpm php-recode-5.3.3-22.el6.x86_64.rpm php-snmp-5.3.3-22.el6.x86_64.rpm php-tidy-5.3.3-22.el6.x86_64.rpm php-zts-5.3.3-22.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://access.redhat.com/security/cve/CVE-2011-1398 https://access.redhat.com/security/cve/CVE-2012-0831 https://access.redhat.com/security/cve/CVE-2012-2688 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2013 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFRJcFqXlSAg2UNWIIRAlARAJ4lNUzK+Ob9fBt1nTCs/ciQY1HF/ACePdIf lPql027HCpjESlPdZVlvCSM=h7Cb -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Feb 21, 2013
Red Hat
87
security advisorydenial of servicecode executionDebian: DSA-2266-1 php5 Moderate: Denial Of Service And Code Execution
Several vulnerabilities were discovered in PHP, which could lead to denial of service or potentially the execution of arbitrary code. CVE-2010-2531 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2266-1
Jun 29, 2011
Debian
99
security advisorysoftware updatesecurity fixSlackware 12.2: 2009-098-02 Moderate PHP Crash Security Fix
New php packages are available for Slackware 11.0, 12.0, 12.1, 12.2, and -current to fix security issues. More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database: . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] php (SSA:2009-098-02) New php packages are available for Slackware 11.0, 12.0, 12.1, 12.2, and -current to fix security issues. More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database: https://www.cve.org/CVERecord?id=CVE-2008-5498 Here are the details from the Slackware 12.2 ChangeLog: +--------------------------+ patches/packages/php-5.2.9-i486-1_slack12.2.tgz: Upgraded to php-5.2.9. This update fixes a few security issues: - Fixed a crash on extract in zip when files or directories entry names contain a relative path. - Fixed security issue in imagerotate(), background colour isn't validated correctly with a non truecolour image. (CVE-2008-5498) Reported by Hamid Ebadi, APA Laboratory. - Fixed a segfault when malformed string is passed to json_decode(). For more information, see: https://www.cve.org/CVERecord?id=CVE-2008-5498 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Updated package for Slackware 11.0: Updated package for Slackware 12.0: Updated package for Slackware 12.1: Updated package for Slackware 12.2: Updated package for Slackware -current: MD5 signatures: +-------------+ Slackware 11.0 package: 0f37384585ba9b364f1fcf3260ed934a php-5.2.9-i486-1_slack11.0.tgz Slackware 12.0 package: b959206d13d76f58ef92489f569b7ff8 php-5.2.9-i486-1_slack12.0.tgz Slackware 12.1 package: bab5d4abc502a0a5dc1831943a5fd1a7 php-5.2.9-i486-1_slack12.1.tgz Slackware 12.2 package: e3c82331a09e0edb6be009e57b2569c9 php-5.2.9-i486-1_slack12.2.tgz Slackware -current package: af4de16b609b4e797dd0fc0a9f4c84d8 php-5.2.9-i486-1.tgz Installationinstructions: +------------------------+ Upgrade the package as root: # upgradepkg php-5.2.9-i486-1_slack12.2.tgz Then, restart the web server. +-----+ . Recent updates for PHP packages are now obtainable for Slackware releases ranging from 11.0 to the latest to tackle critical security vulnerabilities.. php security fix, slackware security update, software upgrade. . Severity: Important. LinuxSecurity.com Team
Apr 08, 2009
•Important
Slackware
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!