Red Hat Security AdvisoryRHSA-2008:0544
php security update
Released 2008-07-16 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Desktop version 3 php-4.3.2-48.ent, php-4.3.2-48.ent.i386, php-devel-4.3.2-48.ent +11
- Red Hat Enterprise Linux (v. 5 server) php-5.1.6-20.el5_2.1, php-5.1.6-20.el5_2.1.i386, php-5.1.6-20.el5_2.1.ia64 +47
- Red Hat Enterprise Linux AS version 3 php-4.3.2-48.ent, php-4.3.2-48.ent.i386, php-4.3.2-48.ent.ia64 +25
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) php-5.1.6-20.el5_2.1, php-5.1.6-20.el5_2.1.i386, php-bcmath-5.1.6-20.el5_2.1 +35
- Red Hat Enterprise Linux ES version 3 php-4.3.2-48.ent, php-4.3.2-48.ent.i386, php-4.3.2-48.ent.ia64 +18
- Red Hat Enterprise Linux WS version 3 php-4.3.2-48.ent, php-4.3.2-48.ent.i386, php-4.3.2-48.ent.ia64 +18
Fixes 6 records
Priority MEDIUM 49
The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion due to insufficient precision, which…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04289 · Published 2008-05-07 · Fixed CWE-331
Priority MEDIUM 48
The escapeshellcmd API function in PHP before 5.2.6 has unknown impact and context-dependent attack vectors related to "incomplete multibyte chars."
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.03102 · Published 2008-05-05 · Fixed
Priority LOW 39
The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 32-bit systems, performs a multiplication using values that can produce a zero seed in rare circumstances, which allows context-depend…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.03392 · Published 2008-05-07 · Fixed CWE-189
Priority LOW 34
The (1) htmlentities and (2) htmlspecialchars functions in PHP before 5.2.5 accept partial multibyte sequences, which has unknown impact and attack vectors, a different issue than CVE-2006-5465.
CVSS 2.0MEDIUM 6.4· Network · No auth · Interaction — · EPSS 0.02788 · Published 2007-11-20 · Fixed
Priority LOW 30
PHP before 5.2.3 allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the pattern parameter to the glob function; or (2) a long string in the string parameter to th…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.04696 · Published 2007-09-10 · Fixed CWE-94
Priority LOW 26
The output_add_rewrite_var function in PHP before 5.2.5 rewrites local forms in which the ACTION attribute references a non-local URL, which allows remote attackers to obtain potentially sensitive information by reading…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.03393 · Published 2007-11-20 · Fixed CWE-200
THREATIST.IORead the docs