~ubuntu-branches/ubuntu/karmic/php5/karmic-security

• Changes
• Files

~ubuntu-branches/ubuntu/karmic/php5/karmic-security » Changes from revision 58

From Revision 57 to 38

expand all

collapse all

Rev		Summary	Authors	Tags	Date	Diff	Files
57		* SECURITY UPDATE: arbitrary files removal via cronjob * SECURITY UPDATE: arbitrary files removal via cronjob   - debian/php5-common.php5.cron.d: take greater care when removing     session files.   - http://git.debian.org/?p=pkg-php%2Fphp.git;a=commitdiff_plain;h=d09fd04ed7bfcf7f008360c6a42025108925df09   - CVE-2011-0441 * SECURITY UPDATE: symlink tmp races in pear install   - debian/patches/php5-pear-CVE-2011-1072.patch: improved     tempfile handling.   - debian/rules: apply patch manually after unpacking PEAR phar     archive.   - CVE-2011-1072 * SECURITY UPDATE: more symlink races in pear install   - debian/patches/php5-pear-CVE-2011-1144.patch: add TOCTOU save     file handler.   - debian/rules: apply patch manually after unpacking PEAR phar     archive.   - CVE-2011-1144 * SECURITY UPDATE: use-after-free vulnerability   - debian/patches/php5-CVE-2010-4697.patch: retain reference to     object until getter/setter are done.   - CVE-2010-4697 * SECURITY UPDATE: denial of service through application crash with   invalid images   - debian/patches/php5-CVE-2010-4698.patch: verify anti-aliasing     steps are either 4 or 16.   - CVE-2010-4698 * SECURITY UPDATE: denial of service through application crash   - debian/patches/php5-CVE-2011-0421.patch: fail operation gracefully     when handling zero sized zipfile with the FL_UNCHANGED argument   - CVE-2011-0421 * SECURITY UPDATE: denial of service through application crash when   handling images with invalid exif tags   - debian/patches/php5-CVE-2011-0708.patch: stricter exif checking   - CVE-2011-0708 * SECURITY UPDATE: denial of service and possible data disclosure   through integer overflow   - debian/patches/php5-CVE-2011-1092.patch: better boundary     condition checks in shmop_read()   - CVE-2011-1092 * SECURITY UPDATE: use-after-free vulnerability   - debian/patches/php5-CVE-2011-1148.patch: improve reference     counting   - CVE-2011-1148 * SECURITY UPDATE: denial of service through buffer overflow crash   (code execution mitigated by compilation with Fortify Source)   - debian/patches/php5-CVE-2011-1464.patch: limit amount of precision     to ensure fitting within MAX_BUF_SIZE   - CVE-2011-1464 * SECURITY UPDATE: denial of service through application crash via   integer overflow.   - debian/patches/php5-CVE-2011-1466.patch: improve boundary     condition checking in SdnToJulian()   - CVE-2011-1466 * SECURITY UPDATE: denial of service through application crash   when using HTTP proxy with the FTP wrapper   - debian/patches/php5-CVE-2011-1469.patch: improve pointer handling   - CVE-2011-1469 * SECURITY UPDATE: denial of service through application crash when   handling ziparchive streams   - debian/patches/php5-CVE-2011-1470.patch: set necessary elements of     the meta data structure   - CVE-2011-1470 * SECURITY UPDATE: denial of service through application crash when   handling malformed zip files   - debian/patches/php5-CVE-2011-1471.patch: correct integer     signedness error when handling zip_fread() return value.   - CVE-2011-1471	Steve Beattie	5.2.10.dfsg.1-2ubuntu6.9	13 years ago
56		debian/patches/php5-CVE-2010-3436-regression.patch: update debian/patches/php5-CVE-2010-3436-regression.patch: update main/fopen_wrappers.c to include fix for open_basedir restriction regression (LP: #701896)	Steve Beattie	5.2.10.dfsg.1-2ubuntu6.7	13 years ago
55		* SECURITY UPDATE: overflow leading to xml decode bypass * SECURITY UPDATE: overflow leading to xml decode bypass   - debian/patches/php5-CVE-2009-5016.patch: convert short to int     to prevent overflow in bit operations   - CVE-2009-5016 * SECURITY UPDATE: xml decode bypass   - debian/patches/php5-CVE-2010-3780.patch: improve utf8 decoding   - CVE-2010-3780 * SECURITY UPDATE: open_basedir bypass   - debian/patches/php5-CVE-2010-3436.patch: more strict checking in     php_check_specific_open_basedir()   - CVE-2010-3436 * SECURITY UPDATE: NULL pointer dereference crash   - debian/patches/php5-CVE-2010-3709.patch: check for NULL when     getting zip comment   - CVE-2010-3709 * SECURITY UPDATE: memory consumption denial of service   - debian/patches/php5-CVE-2010-3710.patch: check for email address     longer than RFC 2821 allows   - CVE-2010-3710 * SECURITY UPDATE: infinite loop/denial of service when dealing with   certain textual forms of MAX_FLOAT (LP: #697181)   - debian/patches/php5-CVE-2010-4645.patch: treat local doubles     as volatile to avoid x87 registers in zend_strtod()   - CVE-2010-4645	Steve Beattie	5.2.10.dfsg.1-2ubuntu6.6	13 years ago
54		* SECURITY UPDATE: denial of service via xmlrpc crafted argu... * SECURITY UPDATE: denial of service via xmlrpc crafted argument   - debian/patches/CVE-2010-0397.patch: make sure method_name isn't empty     in ext/xmlrpc/xmlrpc-epi-php.c, add test to     ext/xmlrpc/tests/bug51288.phpt.   - CVE-2010-0397 * SECURITY UPDATE: weak entropy in Linear Congruential Generator (LCG)   - debian/patches/CVE-2010-1128.patch: add more entropy in     ext/standard/lcg.c.   - CVE-2010-1128 * SECURITY UPDATE: safe_mode bypass via trailing slash in dir pathnames   - debian/patches/CVE-2010-1129.patch: properly validate pathname in     ext/standard/file.c.   - CVE-2010-1129 * SECURITY UPDATE: safe_mode bypass via semicolon in session_save_path   - debian/patches/CVE-2010-1130.patch: check for semicolon in     ext/session/session.c.   - CVE-2010-1130 * SECURITY UPDATE: arbitrary code execution via empty SQL query   - debian/patches/CVE-2010-1868.patch: use ecalloc instead of emalloc in     ext/sqlite/sqlite.c.   - CVE-2010-1868 * SECURITY UPDATE: denial of service via fnmatch stack consumption   - debian/patches/CVE-2010-1917.patch: limit size of pattern in     ext/standard/file.c.   - CVE-2010-1917 * SECURITY UPDATE: sensitive information disclosure or arbitrary code   execution via use-after-free in SplObjectStorage unserializer   - debian/patches/CVE-2010-2225.patch: fix logic in     ext/spl/spl_observer.c.   - CVE-2010-2225 * SECURITY UPDATE: sensitive information disclosure via error messages   - debian/patches/CVE-2010-2531.patch: don't display data when flushing     output buffer in ext/standard/{var.c,php_var.h}, fix tests in     ext/standard/tests/general_functions/*.    - CVE-2010-2531 * SECURITY UPDATE: arbitrary session variable modification via crafted   session variable name   - debian/patches/CVE-2010-3065.patch: handle PS_UNDEF_MARKER marker in     ext/session/session.c.   - CVE-2010-3065	Marc Deslauriers	5.2.10.dfsg.1-2ubuntu6.5	13 years ago
53		* SECURITY UPDATE: information disclosure and denial of serv... * SECURITY UPDATE: information disclosure and denial of service via   zend_restore_ini_entry_cb function.    - debian/patches/CVE-2009-2626.patch: make sure new_value exists in     main/main.c, gracefully handle failure in Zend/zend_ini.c.   - CVE-2009-2626 * SECURITY UPDATE: Cross-site scripting via incomplete htmlspecialchars   filtering   - debian/patches/CVE-2009-4142.patch: rewrite handling logic in     ext/standard/html.c, add ext/standard/tests/strings/bug49785.phpt     test script, fix ext/standard/tests/strings/htmlentities-utf.phpt     test script.   - CVE-2009-4142 * SECURITY UPDATE: restrictions bypass via incorrect session data   handling   - debian/patches/CVE-2009-4143.patch: protect from interrupt     corruption in ext/session/session.c.   - CVE-2009-4143	Marc Deslauriers	5.2.10.dfsg.1-2ubuntu6.4	14 years ago
52		* SECURITY UPDATE: certificate spoofing via null-byte certs ... * SECURITY UPDATE: certificate spoofing via null-byte certs (LP: #446313)   - debian/patches/CVE-2009-3291.patch: validate certificate's CN length     in ext/openssl/openssl.c.   - CVE-2009-3291 * SECURITY UPDATE: denial of service via malformed exif images   (LP: #446313)   - debian/patches/CVE-2009-3292.patch: check length, return codes, and     nesting level in ext/exif/exif.c.   - CVE-2009-3292 * SECURITY UPDATE: safe_mode bypass via tempam function   - debian/patches/CVE-2009-3557.patch: check for safe_mode in     ext/standard/file.c.   - CVE-2009-3557 * SECURITY UPDATE: open_basedir restrictions bypass via posix_mkfifo   - debian/patches/CVE-2009-3558.patch: check for open_basedir in     ext/posix/posix.c.   - CVE-2009-3558 * SECURITY UPDATE: denial of service via large number of files in   form-data POST request.   - debian/patches/CVE-2009-4017.patch: introduce new "max_file_uploads"     directive and enforce in main/main.c, main/rfc1867.c.   - ATTENTION: this update changes previous php5 behaviour by limiting     the number of files in a POST request to 50. This may be increased     by adding a "max_file_uploads" directive to the php.ini configuration     file.    - CVE-2009-4017 * SECURITY UPDATE: safe_mode_protected_env_vars bypass via proc_open()   - debian/patches/CVE-2009-4018.patch: add safe_mode check in     ext/standard/proc_open.c   - CVE-2009-4018	Marc Deslauriers	5.2.10.dfsg.1-2ubuntu6.3	14 years ago
51		debian/rules; Fix broken symlink preventing php-pear from wo... debian/rules; Fix broken symlink preventing php-pear from working properly. (LP: #451277)	Chuck Short	5.2.10.dfsg.1-2ubuntu6	14 years ago
50		* debian/control, debian/patches/115-autoconf_ftbfs.patch:, ... * debian/control, debian/patches/115-autoconf_ftbfs.patch:, debian/series:   Drop patch build-depend on autoconf2.13 * pear/install-pear-nozlib.phar: PHP 5.2.10 was shipped with a broken   install-pear-nozllib.phar which caused pear to be broken. Use the    version from http://pear.php.net. (LP: #420639) * debian/patches/fix-zlib-decompression: Add upstream fix from  5.2.11   fo fix zlibe.deflage compress filter to actually accept level parameter. * debian/rules: Fix symlink for pear.	Chuck Short	5.2.10.dfsg.1-2ubuntu5	14 years ago
49		debian/control: Move to php5-suhoshin to Suggests debian/control: Move to php5-suhoshin to Suggests	Chuck Short	5.2.10.dfsg.1-2ubuntu4	14 years ago
48		debian/control, debian/patches/115-autoconf_ftbfs.patch: Rev... debian/control, debian/patches/115-autoconf_ftbfs.patch: Revert building  with autoconf2.13 since upstream has the proper fix.	Chuck Short	5.2.10.dfsg.1-2ubuntu3	14 years ago
47		debian/control: Change dependencies to MySQL 5.1. debian/control: Change dependencies to MySQL 5.1.	Mathias Gug	5.2.10.dfsg.1-2ubuntu2	14 years ago
46		* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes:   - debian/control, debian/rules: Disable a few build dependencies and     accompanying, binary packages which we do not want to support in main:     + firebird2-dev/php5-interbase (we have a seperate php-interbase source)     + libc-client/php5-imap (we have a seperate php-imap source)     + libmcrypt-dev/php5-mcrypt (seperate php-mycrpt source)     + readline support again, now that the libedit issue is fixed.   - debian/control: Add build dependency: libdedit-dev (>= 2.9.cvs.20050518-1)     CLI readline support.   - debian/rules:     - Correctly mangle PHP5_* macros for lpia   - debian/patches/119-sybase-alias.patch:     +  Fix sybase regression since change to mssql. (LP: #240519)   - debian/patches/fix-autoconf-ftbfs.patch:     + Fixes FTBFS.   - debian/control:      + Use libdb-4.6-dev     + Rename Vcs-Browser & Vcs-Git to XS-Original-Vcs-Browser & XS-Original-Vcs-Git (LP: #323731).     + Use autoconf2.13 to build. Thanks to dreamcast4 (LP: #411890)	Chuck Short	5.2.10.dfsg.1-2ubuntu1	14 years ago
45		* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes:   - debian/control, debian/rules: Disable a few build dependencies and     accompanying binary packages which we do not want to support in main:     + firebird2-dev/php5-interbase (we have a seperate php-interbase source)     + libc-client/php5-imap (we have a seperate php-imap source)     + libmcrypt-dev/php5-mcrypt (seperate php-mycrpt source)     + readline support again, now that the libedit issue is fixed.   - debian/control: Add build dependency: libdedit-dev (>= 2.9.cvs.20050518-1)     CLI readline support   - debian/rules:     - Correctly mangle PHP5_* macros for lpia   - debian/patches/119-sybase-alias.patch:     + Fix sybase regression since change to mssql. (LP: #240519)   - debian/patches/fix-autoconf-ftbfs.patch:     + Fixes FTBFS   - debian/control: Use libdb-4.6-dev * Dropped changes:   - debian/patches/use-specific-libdb-version.patch (LP: #165247), merged     upstream in a previous release. * debian/control: Rename Vcs-Browser & Vcs-Git to XS-Original-Vcs-Browser &    XS-Original-Vcs-Git (LP: #323731)	Andrew Mitchell	5.2.10.dfsg.1-1ubuntu1	14 years ago
44		* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes:   - debian/control, debian/rules: Disable a few build dependencies and     accompanying binary packages which we do not want to support in main:     + firebird2-dev/php5-interbase (we have a seperate php-interbase source)     + libc-client/php5-imap (we have a seperate php-imap source)     + libmcrypt-dev/php5-mcrypt (seperate php-mycrpt source)     + readline support again, now that the libedit issue is fixed.   - debian/control: Add build dependency: libdedit-dev (>= 2.9.cvs.20050518-1)     CLI readline support   - debian/rules:     - Correctly mangle PHP5_* macros for lpia   - debian/patches/use-specific-libdb-version.patch (LP: #165247), mangle     version ordering in patch to match code for clean application.   - debian/patches/119-sybase-alias.patch:     + Fix sybase regression since change to mssql. (LP: #240519)   - debian/patches/fix-autoconf-ftbfs.patch:     + Fixes FTBFS   - debian/control: Use libdb-4.6-dev * Dropped changes:   - debian/patches/fix-pecl-libtool.dpatch:      + included in debian/patches/libtool2.2.patch   - debian/patches/fix-segfault-in-openssl.patch:     + gentoo/010_ext-openssl-utf8-conversion-crash.patch includes it from Debian   - debian/patches/CVE-2009-0754.patch    + Included upstream * debian/control: Rename Vcs-Browser & Vcs-Git to XS-Original-Vcs-Browser &    XS-Original-Vcs-Git (LP: #323731)	Andrew Mitchell	5.2.9.dfsg.1-4ubuntu1	14 years ago
43		* SECURITY UPDATE: arbitrary file write by placing a "php_va... * SECURITY UPDATE: arbitrary file write by placing a "php_value error_log"   entry in a .htaccess file.    - debian/patches/CVE-2008-5625.patch: enforce restrictions when merging     in dir entry in sapi/apache/mod_php5.c and sapi/apache2handler/apache_config.c.   - CVE-2008-5625 * SECURITY UPDATE: mbstring.func_overload setting in .htaccess affects   other virtual hosts.   - debian/patches/CVE-2009-0754.patch: don't terminate on the first     function that is not overloaded in ext/mbstring/mbstring.c.   - CVE-2009-0754	Marc Deslauriers	5.2.6.dfsg.1-3ubuntu4	15 years ago
42		debian/patches/fix-segfault-in-openssl.patch: Fixes sigsegv debian/patches/fix-segfault-in-openssl.patch: Fixes sigsegv  when using openssl_x509_parse (LP: #351730)	Chuck Short	5.2.6.dfsg.1-3ubuntu3	15 years ago
41		debian/patches/fix-autoconf-ftbfs.patch : Fixes a FTBFS. debian/patches/fix-autoconf-ftbfs.patch : Fixes a FTBFS.	Chuck Short	5.2.6.dfsg.1-3ubuntu2	15 years ago
40		* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes:   - debian/control, debian/rules: Disable a few build dependencies and     accompanying binary packages which we do not want to support in main:     + firebird2-dev/php5-interbase (we have a seperate php-interbase source)     + libc-client/php5-imap (we have a seperate php-imap source)     + libmcrypt-dev/php5-mcrypt (seperate php-mycrpt source)     + readline support again, now that the libedit issue is fixed.   - debian/control: Add build dependency: libdedit-dev (>= 2.9.cvs.20050518-1)     CLI readline support   - debian/rules:     - Correctly mangle PHP5_* macros for lpia     - Point /usr/lib/php5/build/{libtool.m4, ltmain.sh} to the right locations.     - Configure with --build=$(DEB_BUILD_GNU_TYPE) --host=$(DEB_HOST_GNU_TYPE)       to fix a build failure on armel.   - debian/patches/use-specific-libdb-version.patch (LP: #165247), mangle     version ordering in patch to match code for clean application.   - debian/patches/119-sybase-alias.patch:     + Fix sybase regression since change to mssql. (LP: #240519)   - debian/control: Use libdb-4.6-dev   - Revert to using upstreams' bundled libtool for now, until either upstream     moves to libtool 2.x, or Debian/Ubuntu have the time to rewrite some m4.   * Manually copy autotools-dev's versions of config.{sub.guess} since we      no long have libtoolize doing it for us, thanks to the above changes.   * debian/patches/fix-pecl-libtool.dpatch: fix libtool brokenness with pecl.     (LP: #262251)   * Dropped debian/patches/deprecated_freetds_check.patch in favor of Debian's.	Chuck Short	5.2.6.dfsg.1-3ubuntu1	15 years ago
39		Configure with --build=$(DEB_BUILD_GNU_TYPE) --host=$(DEB_HO... Configure with --build=$(DEB_BUILD_GNU_TYPE) --host=$(DEB_HOST_GNU_TYPE) to fix a build failure on armel.	Matthias Klose	5.2.6-2ubuntu5	15 years ago
38		debian/patches/fix-pecl-libtool.dpatch: fix libtool brokenne... debian/patches/fix-pecl-libtool.dpatch: fix libtool brokenness with pecl.  (LP: #262251)	Chuck Short	5.2.6-2ubuntu4	15 years ago

• Older »

Loggerhead is a web-based interface for Breezy
Version: 2.0.1