Red Hat Security AdvisoryRHSA-2011:0195
php security update
Released 2011-02-03 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop Optional (v. 6) php-5.3.2-6.el6_0.1, php-bcmath-5.3.2-6.el6_0.1, php-cli-5.3.2-6.el6_0.1 +23
- Red Hat Enterprise Linux HPC Node Optional (v. 6) php-5.3.2-6.el6_0.1, php-bcmath-5.3.2-6.el6_0.1, php-cli-5.3.2-6.el6_0.1 +23
- Red Hat Enterprise Linux Server (v. 6) php-5.3.2-6.el6_0.1, php-cli-5.3.2-6.el6_0.1, php-common-5.3.2-6.el6_0.1 +9
- Red Hat Enterprise Linux Server Optional (v. 6) php-5.3.2-6.el6_0.1, php-bcmath-5.3.2-6.el6_0.1, php-dba-5.3.2-6.el6_0.1 +12
- Red Hat Enterprise Linux Workstation (v. 6) php-5.3.2-6.el6_0.1, php-cli-5.3.2-6.el6_0.1, php-common-5.3.2-6.el6_0.1 +9
- Red Hat Enterprise Linux Workstation Optional (v. 6) php-5.3.2-6.el6_0.1, php-bcmath-5.3.2-6.el6_0.1, php-dba-5.3.2-6.el6_0.1 +12
Fixes 4 records
Priority MEDIUM 43
The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes it easier for remote attackers to bypass cross-site scripting…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.11281 · Published 2010-11-12 · Partial fix CWE-20
Priority LOW 39
strtod.c, as used in the zend_strtod function in PHP 5.2 before 5.2.17 and 5.3 before 5.3.5, and other products, allows context-dependent attackers to cause a denial of service (infinite loop) via a certain floating-poin…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.15103 · Published 2011-01-11 · Fixed CWE-189
Priority LOW 35
The ZipArchive::getArchiveComment function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafte…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.13333 · Published 2010-11-08 · Partial fix CWE-20
Priority LOW 35
Integer overflow in the xml_utf8_decode function in ext/xml/xml.c in PHP before 5.2.11 makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted strin…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.02652 · Published 2010-11-12 · Fixed CWE-189
THREATIST.IORead the docs