Red Hat Security AdvisoryRHSA-2013:0514
php security, bug fix and enhancement update
Released 2013-02-20 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop Optional (v. 6) php-5.3.3-22.el6, php-bcmath-5.3.3-22.el6, php-cli-5.3.3-22.el6 +24
- Red Hat Enterprise Linux HPC Node (v. 6) php-5.3.3-22.el6, php-cli-5.3.3-22.el6, php-common-5.3.3-22.el6
- Red Hat Enterprise Linux HPC Node Optional (v. 6) php-5.3.3-22.el6, php-bcmath-5.3.3-22.el6, php-dba-5.3.3-22.el6 +22
- Red Hat Enterprise Linux Server (v. 6) php-5.3.3-22.el6, php-cli-5.3.3-22.el6, php-common-5.3.3-22.el6 +9
- Red Hat Enterprise Linux Server Optional (v. 6) php-5.3.3-22.el6, php-bcmath-5.3.3-22.el6, php-dba-5.3.3-22.el6 +13
- Red Hat Enterprise Linux Workstation (v. 6) php-5.3.3-22.el6, php-cli-5.3.3-22.el6, php-common-5.3.3-22.el6 +9
- Red Hat Enterprise Linux Workstation Optional (v. 6) php-5.3.3-22.el6, php-bcmath-5.3.3-22.el6, php-dba-5.3.3-22.el6 +13
Fixes 3 records
Priority MEDIUM 56
Unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has unknown impact and remote attack vectors, related to an "overflow."
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.10467 · Published 2012-07-20 · Fixed
Priority LOW 39
PHP before 5.3.10 does not properly perform a temporary change to the magic_quotes_gpc directive during the importing of environment variables, which makes it easier for remote attackers to conduct SQL injection attacks…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.06469 · Published 2012-02-10 · Fixed CWE-20
Priority LOW 33
The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitt…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.10173 · Published 2012-08-30 · Fixed CWE-20
THREATIST.IORead the docs