Red Hat Security AdvisoryRHSA-2010:0040
php security update
Released 2010-01-13 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Desktop version 3 php-4.3.2-54.ent, php-4.3.2-54.ent.i386, php-devel-4.3.2-54.ent +11
- Red Hat Enterprise Linux (v. 5 server) php-5.1.6-24.el5_4.5, php-5.1.6-24.el5_4.5.i386, php-5.1.6-24.el5_4.5.ia64 +47
- Red Hat Enterprise Linux AS version 3 php-4.3.2-54.ent, php-4.3.2-54.ent.i386, php-4.3.2-54.ent.ia64 +25
- Red Hat Enterprise Linux AS version 4 php-4.3.9-3.29, php-4.3.9-3.29.i386, php-4.3.9-3.29.ia64 +47
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) php-5.1.6-24.el5_4.5, php-5.1.6-24.el5_4.5.i386, php-bcmath-5.1.6-24.el5_4.5 +35
- Red Hat Enterprise Linux Desktop version 4 php-4.3.9-3.29, php-4.3.9-3.29.i386, php-devel-4.3.9-3.29 +25
- Red Hat Enterprise Linux ES version 3 php-4.3.2-54.ent, php-4.3.2-54.ent.i386, php-4.3.2-54.ent.ia64 +18
- Red Hat Enterprise Linux ES version 4 php-4.3.9-3.29, php-4.3.9-3.29.i386, php-4.3.9-3.29.ia64 +39
- Red Hat Enterprise Linux WS version 3 php-4.3.2-54.ent, php-4.3.2-54.ent.i386, php-4.3.2-54.ent.ia64 +18
- Red Hat Enterprise Linux WS version 4 php-4.3.9-3.29, php-4.3.9-3.29.i386, php-4.3.9-3.29.ia64 +39
Fixes 6 records
Priority MEDIUM 53
The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct b…
CVSS 2.0HIGH 9.3· Network · No auth · Interaction — · EPSS 0.10247 · Published 2009-10-19 · Partial fix CWE-119
Priority LOW 38
Unspecified vulnerability in PHP before 5.2.11, and 5.3.x before 5.3.1, has unknown impact and attack vectors related to "missing sanity checks around exif processing."
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.02775 · Published 2009-09-22 · Fixed
Priority LOW 38
The php_openssl_apply_verification_policy function in PHP before 5.2.11 does not properly perform certificate validation, which has unknown impact and attack vectors, probably related to an ability to spoof certificates.
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.0291 · Published 2009-09-22 · Fixed CWE-20
Priority LOW 37
PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service (resource exha…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.12041 · Published 2009-11-24 · Fixed CWE-770
Priority LOW 29
The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8 sequences, (2) invalid Shift_JIS sequences, and (3) invalid EUC-JP sequences, which allows remote attackers to conduct cross-…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.06497 · Published 2009-12-21 · Fixed CWE-79
Priority LOW 27
The exif_read_data function in the Exif module in PHP before 5.2.10 allows remote attackers to cause a denial of service (crash) via a malformed JPEG image with invalid offset fields, a different issue than CVE-2005-3353…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.04378 · Published 2009-08-05 · Fixed CWE-20
THREATIST.IORead the docs