~ubuntu-branches/ubuntu/dapper/php5/dapper-security

* SECURITY UPDATE: Multiple vulnerabilities.
* debian/patches/CVE-2006-0996.patch:
  - XSS in phpinfo() [CVE-2006-0996]
  - http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/info.c?r1=1.260&r2=1.261
* debian/patches/CVE-2006-1490.patch:
  - Memory disclosure in html_entity_decode() [CVE-2006-1490]
  - http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/html.c?r1=1.112&r2=1.113
* debian/patches/CVE-2006-1494.patch:
  - Bypassing open_basedir restrictions with tempnam()
    [CVE-2006-1494, CVE-2006-2660]
  - http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/file.c?r1=1.279.2.70.2.4&r2=1.279.2.70.2.5
* debian/patches/CVE-2006-1608.patch:
  - Bypassing open_basedir restrictions with copy() via a source argument
    containing a compress.zlib:// URI [CVE-2006-1494]
  - http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/file.c?r1=1.382.2.10&r2=1.382.2.11
* debian/patches/CVE-2006-1990.patch:
  - Integer overflow in wordwrap function (usually not triggerable from
    outside). [CVE-2006-1990]
  - Zend/zend_alloc.c: Fix variable declaration to work on 64-bit systems to
    plug this vulnerability on amd64/ia64, too. (not yet fixed upstream)
* debian/patches/CVE-2006-1991.patch:
  - DoS with out-of-bounds offset argument to substr_compare()
    [CVE-2006-1991]
* debian/patches/CVE-2006-2563.patch:
  - Bypassing safe mode/open_basedir restrictions with curl module
    [CVE-2006-2563]
  - Patch taken from Mandriva, not fixed upstream.
* debian/patches/CVE-2006-3011.patch:
  - Bypassing safe mode/open_basedir restrictions with error_log() with
    'php://' or other schema in the third argument. [CVE-2006-3011]
  - http://cvs.php.net/viewvc.cgi/php-src/ext/standard/basic_functions.c?r1=1.543.2.51.2.9&r2=1.543.2.51.2.10
* debian/patches/CVE-2006-3016.patch:
  - Check session name for invalid characters to prevent CRLF and other
    malicious injections. [CVE-2006-3016]
  - http://cvs.php.net/viewcvs.cgi/php-src/ext/session/session.c?r1=1.425&r2=1.426
* debian/patches/CVE-2006-3017.patch:
  - Fix zend_hash_del() (previously could delete the wrong element, which
    prevented a variable from being unset even when the PHP unset function
    was called, which might cause the variable's value to be used in
    security-relevant operations). [CVE-2006-3017]
  - http://cvs.php.net/viewcvs.cgi/Zend/zend_hash.c?r1=1.87.4.8.2.1&r2=1.87.4.8.2.3
* debian/patches/CVE-2006-3018.patch:
  - Heap corruption in session extension. [CVE-2006-3018]
  - http://cvs.php.net/viewcvs.cgi/php-src/ext/session/mod_files.c?r1=1.102&r2=1.103