~ubuntu-branches/ubuntu/hardy/php5/hardy-updates : changes

~ubuntu-branches/ubuntu/hardy/php5/hardy-updates » Changes from revision 48

From Revision 48 to 29

Rev	Summary	Authors	Tags	Date
48	* SECURITY UPDATE: arbitrary file disclosure via XML Externa... * SECURITY UPDATE: arbitrary file disclosure via XML External Entity - debian/patches/CVE-2013-1643.patch: disable the entity loader in ext/libxml/libxml.c, ext/libxml/php_libxml.h, ext/soap/php_xml.c. - CVE-2013-1643	Marc Deslauriers	5.2.4-2ubuntu5.27	11 years ago
47	* SECURITY UPDATE: HTTP response-splitting issue with %0D se... * SECURITY UPDATE: HTTP response-splitting issue with %0D sequences - debian/patches/CVE-2011-1398.patch: properly handle %0D and NUL in main/SAPI.c. - CVE-2011-1398 - CVE-2012-4388 * SECURITY UPDATE: denial of service and possible code execution via _php_stream_scandir function (LP: #1028064) - debian/patches/CVE-2012-2688.patch: prevent overflow in main/streams/streams.c. - CVE-2012-2688 * SECURITY UPDATE: denial of service via PDO extension crafted parameter - debian/patches/CVE-2012-3450.patch: improve logic in ext/pdo/pdo_sql_parser.re, regenerate ext/pdo/pdo_sql_parser.c, add test to ext/pdo_mysql/tests/bug_61755.phpt. - CVE-2012-3450	Marc Deslauriers	5.2.4-2ubuntu5.26	11 years ago
46	* SECURITY UPDATE: denial of service via invalid tidy object... * SECURITY UPDATE: denial of service via invalid tidy objects - debian/patches/CVE-2012-0781.patch: track initialization in ext/tidy/tidy.c, added tests to ext/tidy/tests/004.phpt, ext/tidy/tests/bug54682.phpt. - CVE-2012-0781 * SECURITY UPDATE: denial of service or possible directory traversal via invalid filename. - debian/patches/CVE-2012-1172.patch: ensure brackets get closed in main/rfc1867.c, add test to tests/basic/bug55500.phpt. - CVE-2012-1172 * SECURITY UPDATE: improve php5-cgi query string parameter parsing - debian/patches/CVE-2012-233x.patch: improve parsing in sapi/cgi/cgi_main.c. - CVE-2012-2335 - CVE-2012-2336	Marc Deslauriers	5.2.4-2ubuntu5.25	11 years ago
45	* SECURITY UPDATE: php5-cgi query string parameters parsing * SECURITY UPDATE: php5-cgi query string parameters parsing vulnerability - debian/patches/php5-CVE-2012-1823.patch: filter query strings that are prefixed with '-' - CVE-2012-1823 - CVE-2012-2311	Steve Beattie	5.2.4-2ubuntu5.24	11 years ago
44	debian/patches/php5-CVE-2012-0831-regression.patch: fix debian/patches/php5-CVE-2012-0831-regression.patch: fix magic_quotes_gpc ini setting regression introduced by patch for CVE-2012-0831. Thanks to Ondřej Surý for the patch. (LP: #930115)	Steve Beattie	5.2.4-2ubuntu5.23	12 years ago
43	* SECURITY UPDATE: memory allocation failure denial of servi... * SECURITY UPDATE: memory allocation failure denial of service - debian/patches/php5-CVE-2011-4153.patch: check result of zend_strdup() and calloc() for failed allocations - CVE-2011-4153 * SECURITY UPDATE: predictable hash collision denial of service - debian/patches/php5-CVE-2011-4885.patch: add max_input_vars directive with default limit of 1000 - ATTENTION: this update changes previous php5 behavior by limiting the number of external input variables to 1000. This may be increased by adding a "max_input_vars" directive to the php.ini configuration file. See http://www.php.net/manual/en/info.configuration.php#ini.max-input-vars for more information. - CVE-2011-4885 * SECURITY UPDATE: remote code execution vulnerability introduced by the fix for CVE-2011-4885 - debian/patches/php5-CVE-2012-0830.patch: return rather than continuing if max_input_vars limit is reached - CVE-2012-0830 * SECURITY UPDATE: XSLT arbitrary file overwrite attack - debian/patches/php5-CVE-2012-0057.patch: add xsl.security_prefs ini option to define forbidden operations within XSLT stylesheets - CVE-2012-0057 * SECURITY UPDATE: PDORow session denial of service - debian/patches/php5-CVE-2012-0788.patch: fail gracefully when attempting to serialize PDORow instances - CVE-2012-0788 * SECURITY UPDATE: magic_quotes_gpc remote disable vulnerability - debian/patches/php5-CVE-2012-0831.patch: always restore magic_quote_gpc on request shutdown - CVE-2012-0831	Steve Beattie	5.2.4-2ubuntu5.22	12 years ago
42	* SECURITY UPDATE: Denial of service and possible informatio... * SECURITY UPDATE: Denial of service and possible information disclosure via exif integer overflow - debian/patches/php5-CVE-2011-4566.patch: fix count checks in ext/exif/exif.c. - CVE-2011-4566	Marc Deslauriers	5.2.4-2ubuntu5.19	12 years ago
41	[ Angel Abad ] [ Angel Abad ] * SECURITY UPDATE: File path injection vulnerability in RFC1867 File upload filename (LP: #813115) - debian/patches/php5-CVE-2011-2202.patch: - CVE-2011-2202 [ Steve Beattie ] * SECURITY UPDATE: DoS due to failure to check for memory allocation errors - debian/patches/php5-CVE-2011-3182.patch: check the return values of the malloc, calloc, and realloc functions - CVE-2011-3182 * SECURITY UPDATE: Information leak via strchr interrupt (LP: #852865) - debian/patches/php5-CVE-2010-2484.patch: grab references before converting to string - CVE-2010-2484	Steve Beattie	5.2.4-2ubuntu5.18	12 years ago
40	* debian/patches/php5-pear-CVE-2011-1144-regression.patch: f... * debian/patches/php5-pear-CVE-2011-1144-regression.patch: fix mkdir parenthesis issue and PEAR::raiseErro typo (LP: #774452) * debian/patches/php5-CVE-2010-4697-regression.patch: fix regression in reference counting added by fix for CVE-2010-4697 (LP: #776642)	Steve Beattie	5.2.4-2ubuntu5.17	12 years ago
39	* SECURITY UPDATE: arbitrary files removal via cronjob * SECURITY UPDATE: arbitrary files removal via cronjob - debian/php5-common.php5.cron.d: take greater care when removing session files. - http://git.debian.org/?p=pkg-php%2Fphp.git;a=commitdiff_plain;h=d09fd04ed7bfcf7f008360c6a42025108925df09 - CVE-2011-0441 * SECURITY UPDATE: symlink tmp races in pear install - debian/patches/php5-pear-CVE-2011-1072.patch: improved tempfile handling. - debian/rules: apply patch manually after unpacking PEAR phar archive. - CVE-2011-1072 * SECURITY UPDATE: more symlink races in pear install - debian/patches/php5-pear-CVE-2011-1144.patch: add TOCTOU save file handler. - debian/rules: apply patch manually after unpacking PEAR phar archive. - CVE-2011-1144 * SECURITY UPDATE: use-after-free vulnerability - debian/patches/php5-CVE-2010-4697.patch: retain reference to object until getter/setter are done. - CVE-2010-4697 * SECURITY UPDATE: denial of service through application crash with invalid images - debian/patches/php5-CVE-2010-4698.patch: verify anti-aliasing steps are either 4 or 16. - CVE-2010-4698 * SECURITY UPDATE: denial of service through application crash - debian/patches/php5-CVE-2011-0421.patch: fail operation gracefully when handling zero sized zipfile with the FL_UNCHANGED argument - CVE-2011-0421 * SECURITY UPDATE: denial of service through application crash when handling images with invalid exif tags - debian/patches/php5-CVE-2011-0708.patch: stricter exif checking - CVE-2011-0708 * SECURITY UPDATE: denial of service and possible data disclosure through integer overflow - debian/patches/php5-CVE-2011-1092.patch: better boundary condition checks in shmop_read() - CVE-2011-1092 * SECURITY UPDATE: use-after-free vulnerability - debian/patches/php5-CVE-2011-1148.patch: improve reference counting - CVE-2011-1148 * SECURITY UPDATE: denial of service through buffer overflow crash (code execution mitigated by compilation with Fortify Source) - debian/patches/php5-CVE-2011-1464.patch: limit amount of precision to ensure fitting within MAX_BUF_SIZE - CVE-2011-1464 * SECURITY UPDATE: denial of service through application crash via integer overflow. - debian/patches/php5-CVE-2011-1466.patch: improve boundary condition checking in SdnToJulian() - CVE-2011-1466 * SECURITY UPDATE: denial of service through application crash when using HTTP proxy with the FTP wrapper - debian/patches/php5-CVE-2011-1469.patch: improve pointer handling - CVE-2011-1469 * SECURITY UPDATE: denial of service through application crash when handling ziparchive streams - debian/patches/php5-CVE-2011-1470.patch: set necessary elements of the meta data structure - CVE-2011-1470 * SECURITY UPDATE: denial of service through application crash when handling malformed zip files - debian/patches/php5-CVE-2011-1471.patch: correct integer signedness error when handling zip_fread() return value. - CVE-2011-1471	Steve Beattie	5.2.4-2ubuntu5.15	13 years ago
38	debian/patches/php5-CVE-2010-3436-regression.patch: update debian/patches/php5-CVE-2010-3436-regression.patch: update main/fopen_wrappers.c to include fix for open_basedir restriction regression (LP: #701896)	Steve Beattie	5.2.4-2ubuntu5.14	13 years ago
37	* SECURITY UPDATE: overflow leading to xml decode bypass * SECURITY UPDATE: overflow leading to xml decode bypass - debian/patches/php5-CVE-2009-5016.patch: convert short to int to prevent overflow in bit operations - CVE-2009-5016 * SECURITY UPDATE: xml decode bypass - debian/patches/php5-CVE-2010-3780.patch: improve utf8 decoding - CVE-2010-3780 * SECURITY UPDATE: open_basedir bypass - debian/patches/php5-CVE-2010-3436.patch: more strict checking in php_check_specific_open_basedir() - CVE-2010-3436 * SECURITY UPDATE: NULL pointer dereference crash - debian/patches/php5-CVE-2010-3709.patch: check for NULL when getting zip comment - CVE-2010-3709 * SECURITY UPDATE: memory consumption denial of service - debian/patches/php5-CVE-2010-3710.patch: check for email address longer than RFC 2821 allows - CVE-2010-3710 * SECURITY UPDATE: infinite loop/denial of service when dealing with certain textual forms of MAX_FLOAT (LP: #697181) - debian/patches/php5-CVE-2010-4645.patch: treat local doubles as volatile to avoid x87 registers in zend_strtod() - CVE-2010-4645	Steve Beattie	5.2.4-2ubuntu5.13	13 years ago
36	* SECURITY UPDATE: denial of service via xmlrpc crafted argu... * SECURITY UPDATE: denial of service via xmlrpc crafted argument - debian/patches/CVE-2010-0397.patch: make sure method_name isn't empty in ext/xmlrpc/xmlrpc-epi-php.c, add test to ext/xmlrpc/tests/bug51288.phpt. - CVE-2010-0397 * SECURITY UPDATE: weak entropy in Linear Congruential Generator (LCG) - debian/patches/CVE-2010-1128.patch: add more entropy in ext/standard/lcg.c. - CVE-2010-1128 * SECURITY UPDATE: safe_mode bypass via trailing slash in dir pathnames - debian/patches/CVE-2010-1129.patch: properly validate pathname in ext/standard/file.c. - CVE-2010-1129 * SECURITY UPDATE: safe_mode bypass via semicolon in session_save_path - debian/patches/CVE-2010-1130.patch: check for semicolon in ext/session/session.c. - CVE-2010-1130 * SECURITY UPDATE: arbitrary code execution via empty SQL query - debian/patches/CVE-2010-1868.patch: use ecalloc instead of emalloc in ext/sqlite/sqlite.c. - CVE-2010-1868 * SECURITY UPDATE: denial of service via fnmatch stack consumption - debian/patches/CVE-2010-1917.patch: limit size of pattern in ext/standard/file.c. - CVE-2010-1917 * SECURITY UPDATE: sensitive information disclosure or arbitrary code execution via use-after-free in SplObjectStorage unserializer - debian/patches/CVE-2010-2225.patch: fix logic in ext/spl/spl_observer.c. - CVE-2010-2225 * SECURITY UPDATE: sensitive information disclosure via error messages - debian/patches/CVE-2010-2531.patch: don't display data when flushing output buffer in ext/standard/{var.c,php_var.h}. - CVE-2010-2531 * SECURITY UPDATE: arbitrary session variable modification via crafted session variable name - debian/patches/CVE-2010-3065.patch: handle PS_UNDEF_MARKER marker in ext/session/session.c. - CVE-2010-3065	Marc Deslauriers	5.2.4-2ubuntu5.12	13 years ago
35	* SECURITY UPDATE: information disclosure and denial of serv... * SECURITY UPDATE: information disclosure and denial of service via zend_restore_ini_entry_cb function. - debian/patches/CVE-2009-2626.patch: make sure new_value exists in main/main.c, gracefully handle failure in Zend/zend_ini.c. - CVE-2009-2626 * SECURITY UPDATE: Cross-site scripting via incomplete htmlspecialchars filtering - debian/patches/CVE-2009-4142.patch: rewrite handling logic in ext/standard/html.c, add ext/standard/tests/strings/bug49785.phpt test script. - CVE-2009-4142 * SECURITY UPDATE: restrictions bypass via incorrect session data handling - debian/patches/CVE-2009-4143.patch: protect from interrupt corruption in ext/session/session.c. - CVE-2009-4143	Marc Deslauriers	5.2.4-2ubuntu5.10	14 years ago
34	* SECURITY UPDATE: file truncation via key with null byte * SECURITY UPDATE: file truncation via key with null byte - debian/patches/CVE-2008-7068.patch: make sure key and value are sane in ext/dba/libinifile/inifile.c. - CVE-2008-7068 * SECURITY UPDATE: certificate spoofing via null-byte certs (LP: #446313) - debian/patches/CVE-2009-3291.patch: validate certificate's CN length in ext/openssl/openssl.c. - CVE-2009-3291 * SECURITY UPDATE: denial of service via malformed exif images (LP: #446313) - debian/patches/CVE-2009-3292.patch: check length, return codes, and nesting level in ext/exif/exif.c. - CVE-2009-3292 * SECURITY UPDATE: safe_mode bypass via tempam function - debian/patches/CVE-2009-3557.patch: check for safe_mode in ext/standard/file.c. - CVE-2009-3557 * SECURITY UPDATE: open_basedir restrictions bypass via posix_mkfifo - debian/patches/CVE-2009-3558.patch: check for open_basedir in ext/posix/posix.c. - CVE-2009-3558 * SECURITY UPDATE: denial of service via large number of files in form-data POST request. - debian/patches/CVE-2009-4017.patch: introduce new "max_file_uploads" directive and enforce in main/main.c, main/rfc1867.c. - ATTENTION: this update changes previous php5 behaviour by limiting the number of files in a POST request to 50. This may be increased by adding a "max_file_uploads" directive to the php.ini configuration file. - CVE-2009-4017 * SECURITY UPDATE: safe_mode_protected_env_vars bypass via proc_open() - debian/patches/CVE-2009-4018.patch: add safe_mode check in ext/standard/proc_open.c - CVE-2009-4018	Marc Deslauriers	5.2.4-2ubuntu5.9	14 years ago
33	* SECURITY UPDATE: denial of service via malformed JPEG imag... * SECURITY UPDATE: denial of service via malformed JPEG image with invalid offset fields - debian/patches/131_SECURITY_CVE-2009-2687.patch: validate offset_of_ifd in ext/exif/exif.c. - CVE-2009-2687	Marc Deslauriers	5.2.4-2ubuntu5.7	14 years ago
32	* SECURITY UPDATE: cross-site scripting vulnerability when d... * SECURITY UPDATE: cross-site scripting vulnerability when display_errors is enabled. - debian/patches/128_SECURITY_CVE-2008-5814.patch: don't print back cookie names or values in ext/standard/head.c. - CVE-2008-5814 * SECURITY UPDATE: mbstring.func_overload setting in .htaccess affects other virtual hosts. - debian/patches/129_SECURITY_CVE-2009-0754.patch: don't terminate on the first function that is not overloaded in ext/mbstring/mbstring.c. - CVE-2009-0754 * SECURITY UPDATE: denial of service via malformed string to the json_decode API function. - debian/patches/130_SECURITY_CVE-2009-1271.patch: add extra mode checks in ext/json/JSON_parser.c. Add test to ext/json/tests/001.phpt. - CVE-2009-1271	Marc Deslauriers	5.2.4-2ubuntu5.6	15 years ago
31	* SECURITY UPDATE: php_admin_value and php_admin_flag restri... * SECURITY UPDATE: php_admin_value and php_admin_flag restrictions bypass via ini_set. (LP: #228095) - debian/patches/120_SECURITY_CVE-2007-5900.patch: add new zend_alter_ini_entry_ex() function that extends zend_alter_ini_entry() by making sure the entry can be modified in Zend/zend_ini.{c,h}, Zend/zend_vm_def.h, and Zend/zend_vm_execute.h. - CVE-2007-5900 * SECURITY UPDATE: denial of service and possible arbitrary code execution via crafted font file. (LP: #286851) - debian/patches/121_SECURITY_CVE-2008-3658.patch: make sure font->nchars, font->h, and font->w don't cause overflows in ext/gd/gd.c. Also, add test script ext/gd/tests/imageloadfont_invalid.phpt. - CVE-2008-3658 * SECURITY UPDATE: denial of service and possible arbitrary code execution via the delimiter argument to the explode function. (LP: #286851) - debian/patches/122_SECURITY_CVE-2008-3659.patch: make sure needle_length is sane in ext/standard/tests/strings/explode_bug.phpt. Also, add test script ext/standard/tests/strings/explode_bug.phpt. - CVE-2008-3659 * SECURITY UPDATE: denial of service via a request with multiple dots preceding the extension. (ex: foo..php) (LP: #286851) - debian/patches/123_SECURITY_CVE-2008-3660.patch: improve .. cleaning with a new is_valid_path() function in sapi/cgi/cgi_main.c. - CVE-2008-3660 * SECURITY UPDATE: mbstring extension arbitrary code execution via crafted string containing HTML entity. (LP: #317672) - debian/patches/124_SECURITY_CVE-2008-5557.patch: improve mbfl_filt_conv_html_dec_flush() error handling in ext/mbstring/libmbfl/filters/mbfilter_htmlent.c. - CVE-2008-5557 * SECURITY UPDATE: safe_mode restriction bypass via unrestricted variable settings. - debian/patches/125_SECURITY_CVE-2008-5624.patch: make sure the page_uid and page_gid get initialized properly in ext/standard/basic_functions.c. Also, init server_context before processing config variables in sapi/apache/mod_php5.c. - CVE-2008-5624 * SECURITY UPDATE: arbitrary file write by placing a "php_value error_log" entry in a .htaccess file. - debian/patches/126_SECURITY_CVE-2008-5625.patch: enforce restrictions when merging in dir entry in sapi/apache/mod_php5.c and sapi/apache2handler/apache_config.c. - CVE-2008-5625 * SECURITY UPDATE: arbitrary file overwrite from directory traversal via zip file with dot-dot filenames. - debian/patches/127_SECURITY_CVE-2008-5658.patch: clean up filename paths in ext/zip/php_zip.c with new php_zip_realpath_r(), php_zip_virtual_file_ex() and php_zip_make_relative_path() functions. - CVE-2008-5658	Marc Deslauriers	5.2.4-2ubuntu5.5	15 years ago
30	[ Tormod Volden ] [ Tormod Volden ] * Backport security fixes from 5.2.6: (LP: #227464) - debian/patches/SECURITY_CVE-2008-2050.patch + Fixed possible stack buffer overflow in FastCGI SAPI + Fixed sending of uninitialized paddings which may contain some information - debian/patches/SECURITY_CVE-2008-0599.patch + Fixed security issue detailed in CVE-2008-0599 - debian/patches/SECURITY_CVE-2007-4850.patch + Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz - debian/patches/security526-pcre_compile.patch: + avoid stack overflow (fix from pcre 7.6) [ Jamie Strandboge ] * debian/patches/SECURITY_CVE-2008-2051.patch: properly address incomplete multibyte chars inside escapeshellcmd() (thanks Tormod Volden) * Add debian/patches/SECURITY_CVE-2007-5898.patch: don't accept partial utf8 sequences. Backported upstream fixes. * Add debian/patches/SECURITY_CVE-2007-5899.patch: don't send session id to remote forms. Backported upstream fixes. * Add debian/patches/SECURITY_CVE-2008-2829.patch: unsafe usage of deprecated imap functions (patch from Debian) * Add debian/patches/SECURITY_CVE-2008-1384.patch: integer overflow in printf() (patch from Debian) * Add debian/patches/SECURITY_CVE-2008-2107+2108.patch: weak random number seed. Backported upstream patches. * Add debian/patches/SECURITY_CVE-2007-4782.patch: DoS via long string in the fnmatch functions * Add debian/patches/SECURITY_CVE-2008-2371.patch: buffer overflow. Backported upstream patches. * References CVE-2008-2050 CVE-2008-2051 CVE-2008-0599 CVE-2007-4850 CVE-2007-5898 CVE-2007-5899 CVE-2008-2829 CVE-2008-1384 CVE-2008-2107 CVE-2008-2108 CVE-2007-4782 CVE-2008-2371	Jamie Strandboge	5.2.4-2ubuntu5.3	15 years ago
29	* fixes strtotime support for 64 bit timestamps (LP: #194318... * fixes strtotime support for 64 bit timestamps (LP: #194318) - Upstream: http://bugs.php.net/bug.php?id=44209 * Update tests to account for newly working timestamps - Upstream: http://bugs.php.net/?id=44219	Dustin Kirkland	5.2.4-2ubuntu5	16 years ago

Older »