php -- multiple vulnerabilities

Description:

The PHP development team reports:

Security Enhancements and Fixes in PHP 5.2.2 and PHP 4.4.7:

• Fixed CVE-2007-1001, GD wbmp used with invalid image size
• Fixed asciiz byte truncation inside mail()
• Fixed a bug in mb_parse_str() that can be used to activate register_globals
• Fixed unallocated memory access/double free in in array_user_key_compare()
• Fixed a double free inside session_regenerate_id()
• Added missing open_basedir & safe_mode checks to zip:// and bzip:// wrappers.
• Limit nesting level of input variables with max_input_nesting_level as fix for.
• Fixed CRLF injection inside ftp_putcmd().
• Fixed a possible super-global overwrite inside import_request_variables().
• Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library.

Security Enhancements and Fixes in PHP 5.2.2 only:

• Fixed a header injection via Subject and To parameters to the mail() function
• Fixed wrong length calculation in unserialize S type.
• Fixed substr_compare and substr_count information leak.
• Fixed a remotely trigger-able buffer overflow inside make_http_soap_request().
• Fixed a buffer overflow inside user_filter_factory_create().

Security Enhancements and Fixes in PHP 4.4.7 only:

• XSS in phpinfo()

References:

• CVE name CVE-2007-1001
• URL: <http://www.php.net/releases/4_4_7.php>
• URL: <http://www.php.net/releases/5_2_2.php>

Affects:

• php5-imap <5.2.2
• php5-odbc <5.2.2
• php5-session <5.2.2
• php5-shmop <5.2.2
• php5-sqlite <5.2.2
• php5-wddx <5.2.2
• php5 <5.2.2
• php4-odbc <4.4.7
• php4-session <4.4.7
• php4-shmop <4.4.7
• php4-wddx <4.4.7
• php4 <4.4.7
• mod_php4-twig >=0
• mod_php4 >=0
• mod_php5 >=0
• mod_php >=0
• php4-cgi >=0
• php4-cli >=0
• php4-dtc >=0
• php4-horde >=0
• php4-nms >=0
• php5-cgi >=0
• php5-cli >=0
• php5-dtc >=0
• php5-horde >=0
• php5-nms >=0

Disclaimer: The data contained on this page is derived from the VuXML document, please refer to the the original document for copyright information. The author of portaudit makes no claim of authorship or ownership of any of the information contained herein.

If you have found a vulnerability in a FreeBSD port not listed in the database, please contact the FreeBSD Security Team. Refer to "FreeBSD Security Information" for more information.