Red Hat Security AdvisoryRHSA-2009:0337
php security update
Released 2009-04-06 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Desktop version 3 php-4.3.2-51.ent, php-4.3.2-51.ent.i386, php-devel-4.3.2-51.ent +11
- Red Hat Enterprise Linux AS version 3 php-4.3.2-51.ent, php-4.3.2-51.ent.i386, php-4.3.2-51.ent.ia64 +25
- Red Hat Enterprise Linux AS version 4 php-4.3.9-3.22.15, php-4.3.9-3.22.15.i386, php-4.3.9-3.22.15.ia64 +47
- Red Hat Enterprise Linux Desktop version 4 php-4.3.9-3.22.15, php-4.3.9-3.22.15.i386, php-devel-4.3.9-3.22.15 +25
- Red Hat Enterprise Linux ES version 3 php-4.3.2-51.ent, php-4.3.2-51.ent.i386, php-4.3.2-51.ent.ia64 +18
- Red Hat Enterprise Linux ES version 4 php-4.3.9-3.22.15, php-4.3.9-3.22.15.i386, php-4.3.9-3.22.15.ia64 +39
- Red Hat Enterprise Linux WS version 3 php-4.3.2-51.ent, php-4.3.2-51.ent.i386, php-4.3.2-51.ent.ia64 +18
- Red Hat Enterprise Linux WS version 4 php-4.3.9-3.22.15, php-4.3.9-3.22.15.i386, php-4.3.9-3.22.15.ia64 +39
Fixes 5 records
Priority MEDIUM 53
Heap-based buffer overflow in ext/mbstring/libmbfl/filters/mbfilter_htmlent.c in the mbstring extension in PHP 4.3.0 through 5.2.6 allows context-dependent attackers to execute arbitrary code via a crafted string contain…
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.07371 · Published 2008-12-23 · Fixed CWE-119
Priority MEDIUM 43
Buffer overflow in the imageloadfont function in ext/gd/gd.c in PHP 4.4.x before 4.4.9 and PHP 5.2 before 5.2.6-r6 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary co…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.06847 · Published 2008-08-15 · Fixed CWE-119
Priority LOW 34
Array index error in the imageRotate function in PHP 5.2.8 and earlier allows context-dependent attackers to read the contents of arbitrary memory locations via a crafted value of the third argument (aka the bgd_color or…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.08845 · Published 2008-12-26 · Fixed CWE-200
Priority LOW 29
PHP 4.4.x before 4.4.9, and 5.x through 5.2.6, when used as a FastCGI module, allows remote attackers to cause a denial of service (crash) via a request with multiple dots preceding the extension, as demonstrated using f…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.03346 · Published 2008-08-15 · Fixed CWE-20
Priority LOW 13
PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which cau…
CVSS 2.0LOW 2.1· Local · No auth · Interaction — · EPSS 0.00948 · Published 2009-03-03 · Fixed CWE-134
THREATIST.IORead the docs