~ubuntu-branches/ubuntu/feisty/php5/feisty-security

• Changes
• Files

~ubuntu-branches/ubuntu/feisty/php5/feisty-security » Changes from revision 21

From Revision 21 to 2

expand all

collapse all

Rev		Summary	Authors	Tags	Date	Diff	Files
21		* debian/patches/209-CVE-2008-2050.patch: possible stack ove... * debian/patches/209-CVE-2008-2050.patch: possible stack overflow and   sending of unitialized paddings * debian/patches/210-CVE-2008-2051.patch: properly address incomplete   multibyte chars inside escapeshellcmd() * debian/patches/211-CVE-2007-4850.patch: fixed a safe_mode bypass in cURL * debian/patches/212-CVE-2008-2829.patch: unsafe usage of deprecated imap   functions (patch from Debian) * debian/patches/213-CVE-2008-1384.patch: integer overflow in printf()   (patch from Debian) * debian/patches/214-CVE-2008-2107+2108.patch: weak random number seed * debian/patches/215-CVE-2007-4782.patch: DoS via long string in the fnmatch   functions * debian/patches/216-pcre-compile.patch: avoid stack overflow (fix from   pcre 7.6) * Update debian/patches/207-htmlentity-utf8-fix.patch: fail on improperly   finished UTF sequence * References   CVE-2008-2050   CVE-2008-2051   CVE-2007-4850   CVE-2008-2829   CVE-2008-1384   CVE-2008-2107   CVE-2008-2108   CVE-2007-4782   CVE-2007-5898   LP: #227464	Jamie Strandboge	5.2.1-0ubuntu1.6	15 years ago
20		* SECURITY UPDATE: multiple vulnerabilities. Thanks to Sean... * SECURITY UPDATE: multiple vulnerabilities.  Thanks to Sean Finney for   help locating upstream fixes. * Add 200-string-wordwrap.patch: wordwrap function can be made to crash.   Backported upstream fixes (CVE-2007-3998). * Add 201-strspn-oob-read.patch: memory reading, possible crash via strspn.   chunk_split.  Backported upstream fixes (CVE-2007-4657). * Add 202-money-format-abuse.patch: money_format format string vulnerable.   Backported upstream fixes (CVE-2007-4658). * Add 203-openssl_make_REQ-overflow.patch: overflow in openssl_make_REQ.   Applied and corrected upstream fixes (CVE-2007-4662). * Add 204-start-session-cookies.patch: overwrite cookie values.   Applied upstream fixes (CVE-2007-3799). * Add 206-chunk_split-fixes.patch: memory reading, possible crash via   chunk_split.  Merged various upstream fixes (CVE-2007-2872, CVE-2007-4660,   CVE-2007-4661). * Add 206-cookie-nesting-fix.patch: corruption/crashes via deeply nested   variables.  Backported upstream fixes (CVE-2007-1285, CVE-2007-4670). * Add 207-htmlentity-utf8-fix.patch: don't accept partial utf8 sequences.   Backported upstream fixes (CVE-2007-5898). * Add 208-session-id-leak.patch: don't send session id to remote forms.   Backported upstream fixes (CVE-2007-5899). * References   http://www.php.net/releases/5_2_4.php   http://www.php.net/releases/5_2_5.php	Kees Cook	5.2.1-0ubuntu1.5	16 years ago
19		* SECURITY UPDATE: arbitrary code execution via heap overflo... * SECURITY UPDATE: arbitrary code execution via heap overflow, uninitialized   random seed in SOAP. * Add debian/patches/122-CVE-2007-1864-xmlrpc.patch: upstream fix   (CVE-2007-1864). * Add debian/patches/122-CVE-2007-2728_soap-seed.patch: upstream fix   (CVE-2007-2728).	Kees Cook	5.2.1-0ubuntu1.4	16 years ago
18		* SECURITY UPDATE: FTP command injection, code execution in ... * SECURITY UPDATE: FTP command injection, code execution in SOAP requests,   PEAR installer path traversal. * 121-CVE-2007-2509_ftp.patch: ported from upstream and Debian   (CVE-2007-2509) * 121-CVE-2007-2510_soap.patch: ported from upstream and Debian   (CVE-2007-2510) * pear/121-pear-installer.patch: extracted from upstream changes   (CVE-2007-2519)	Kees Cook	5.2.1-0ubuntu1.2	16 years ago
17		* SECURITY UPDATE: multiple security vulnerabilities fixed. ... * SECURITY UPDATE: multiple security vulnerabilities fixed.  Thanks to   Moritz Muehlenhoff and Sean Finney. * 120-MOPB-10.patch: php_binary Session Deserialization Information Leak   (CVE-2007-1380) * 120-MOPB-14.patch: substr_compare() Information Leak (CVE-2007-1375) * 120-MOPB-22.patch: session_regenerate_id() Double Free (CVE-2007-1521) * 120-MOPB-24.patch: array_user_key_compare() Double DTOR (CVE-2007-1484) * 120-MOPB-26.patch: mb_parse_str() register_globals Activation   (CVE-2007-1583) * 120-MOPB-29.patch: unserialize() Information Leak * 120-MOPB-34.patch: mail() Header Injection (CVE-2007-1718) * 120-MOPB-41.patch: sqlite_udf_decode_binary() Buffer Overflow   (CVE-2007-1887 CVE-2007-1888) * 120-MOPB-45.patch: ext/filter Email Validation (CVE-2007-1900)	Kees Cook	5.2.1-0ubuntu1.1	17 years ago
16		* New upstream security/bugfix release: * New upstream security/bugfix release:   - safe_mode & open_basedir bypasses inside the session extension     [CVE-2007-0905]   - multiple buffer overflows in various extensions and functions     [CVE-2007-0906]   - underflow in the internal sapi_header_op() function [CVE-2007-0907]   - information disclosure in the wddx extension [CVE-2007-0908]   - string format vulnerability in *print() functions on 64 bit systems     [CVE-2007-0909]   - possible clobbering of super-globals in several code paths     [CVE-2007-0910] * Adapted patches to new upstream release:   - 006-debian_quirks.patch   - 034-apache2_umask_fix.patch   - 044-strtod_arm_fix.patch * Drop 109-libdb4.4.patch: Obsolete, upstream now checks for db 4.5 and 4.4. * Drop 114-zend_alloc.c_m68k_alignment.patch and   115-zend_alloc.c_memleak.patch: Applied upstream. * Add debian/patches/000upstream-str_ireplace_offbyone.patch:   - Fix off-by-one in str_ireplace(), a regression introduced in 5.2.1.   - Patch taken from upstream CVS:     http://cvs.php.net/viewvc.cgi/php-src/ext/standard/string.c?r1=1.630&r2=1.631   - CVE-2007-0911 * debian/control: Set Ubuntu maintainer.	Martin Pitt	5.2.1-0ubuntu1	17 years ago
15		No-change upload for the libpq4->libpq5 transition. No-change upload for the libpq4->libpq5 transition.	Martin Pitt	5.2.0-8ubuntu2	17 years ago
14		* Merge to Debian unstable. * Merge to Debian unstable. * Build against libapr1-dev and depend against apache2.2-common again, now   that we have it in Feisty. * Build against db 4.4 (like Debian), since Apache 2.2 now uses it, too. * Remaining Ubuntu changes:   - debian/control, debian/rules: Disable apache-dev build dependency and     remove libapache-mod-php5 package, since we do not support apache 1.3.   - debian/changelog: Add some missing CVEs.   - Remove firebird2-dev build dependency and php5-interbase package, since     we don't support Firebird and keep the separate php-interbase source.   - Remove libc-client-dev build dependency and php5-imap package, since     uw-imapd is in universe and we keep the separate php-imap source.   - Remove libmcrypt-dev build dependency and php5-mcrypt package, since     it is in universe and we keep the separate php-mcrypt source.   - Add missing libsqlite3-dev build dependency.	Martin Pitt	5.2.0-8ubuntu1	17 years ago
13		debian/control: Add missing build dependency libsqlite3-dev ... debian/control: Add missing build dependency libsqlite3-dev to fix FTBFS.	Martin Pitt	5.2.0-7ubuntu2	17 years ago
12		* Merge to Debian unstable; remaining Ubuntu changes: * Merge to Debian unstable; remaining Ubuntu changes:   - debian/control, debian/rules: Disable apache-dev build dependency and     remove libapache-mod-php5 package, since we do not support apache 1.3.   - debian/control: Build with db4.3, as long as our apache needs it.   - debian/changelog: Add some missing CVEs. * debian/control:   - Remove firebird2-dev build dependency and php5-interbase package, since     we don't support Firebird and keep the separate php-interbase source.   - Remove libc-client-dev build dependency and php5-imap package, since     uw-imapd is in universe and we keep the separate php-imap source.   - Remove libmcrypt-dev build dependency and php5-mcrypt package, since     it is in universe and we keep the separate php-mcrypt source.   - libapr1-dev -> libapr0-dev, as long as we still have Apache 2.0. * debian/rules: Disable above modules, and fix up dependency generation for   Apache 2.0 instead of 2.2.	Martin Pitt	5.2.0-7ubuntu1	17 years ago
11		Rebuild for ldbl128 change on powerpc and sparc. Rebuild for ldbl128 change on powerpc and sparc.	Matthias Klose	5.1.6-1ubuntu3	17 years ago
10		* SECURITY UPDATE: Safe mode bypass, remote arbitrary code e... * SECURITY UPDATE: Safe mode bypass, remote arbitrary code execution. * Fix/add CVE numbers in/to 5.1.4-0.1 and 5.1.6-1 changelogs. * Add debian/patches/CVE-2006-4625.patch:   - Fix open_basedir/safe_mode bypass with ini_restore().   - Ported from upstream CVS:     http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_ini.c?r1=1.39.2.2&r2=1.39.2.3 * Add debian/patches/CVE-2006-4812.patch:   - Fix integer overflow in Zend's ecalloc().   - Ported from upstream CVS:     http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_alloc.c?r1=1.161&r2=1.162	Martin Pitt	5.1.6-1ubuntu2	17 years ago
9		* Merge from Debian unstable, bringing in a myriad of securi... * Merge from Debian unstable, bringing in a myriad of security fixes. * Revert libdb4.3->libdb4.4 migration until we're ready to do this.	Adam Conrad	5.1.6-1ubuntu1	17 years ago
8		Merge from debian unstable. Merge from debian unstable.	Fabio M. Di Nitto	5.1.4-0.1ubuntu1	17 years ago
7		* Enable the mysqli extension, which is required for full fu... * Enable the mysqli extension, which is required for full functionality   of the ubuntu-server LAMP stack for dapper (launchpad.net/27904) * Make php5-{mysql,mysqli} depend on each other to ease the pain of the   planned transition for Etch/Edgy where both will be packaged together. * Comment out the EXTRA_VERSION hack, since it served its purpose when   we were providing CVS snapshots, but is now just a cause of complaints.	Adam Conrad	5.1.2-1ubuntu3	17 years ago
6		Rebuild against the new libmysqlclient15off with correct sym... Rebuild against the new libmysqlclient15off with correct symbols.	Adam Conrad	5.1.2-1ubuntu2	18 years ago
5		Resynchronise with Debian, bringing in security fixes and PE... Resynchronise with Debian, bringing in security fixes and PEAR fix.	Adam Conrad	5.1.2-1ubuntu1	18 years ago
4		Resynchronise with Debian, bringing in a myriad of security ... Resynchronise with Debian, bringing in a myriad of security fixes.	Adam Conrad	5.1.1-1ubuntu1	18 years ago
3		Rebuild for libstdc++ allocator change Rebuild for libstdc++ allocator change	Matthias Klose	5.0.5-2ubuntu2	18 years ago
2		Resync with Debian, bringing in two security fixes, a file c... Resync with Debian, bringing in two security fixes, a file conflict fix, and two 64-bit memory corruption and segfault fixes (no other changes).	Adam Conrad	5.0.5-2ubuntu1	18 years ago

• Older »

Loggerhead is a web-based interface for Breezy
Version: 2.0.1