PHP 5.2.2 fixes several vulnerabilities

[Fridtjof Busse]

Binary package hint: php5

PHP 5.2.2 fixes several vulnerabilities, of which some could possibly be triggered externally. This should get fixed asap.
http://www.php.net/releases/5_2_2.php

[David Garcia Rojo (ouioui51)]

Hi,
I have multiple security hole concerning apache and PHP5
I've used nessus to find them.

I think the report i've attach could help for resolving them
We've just to update to new package

[Fridtjof Busse (fbusse-deactivatedaccount-deactivatedaccount)]

A Nessus-logfile is not really helpful, especially as most of the problems found have already been fixed with USN-455-1.
Nonetheless, is anybody working on this?

[Kees Cook (kees)]

On Sun, May 06, 2007 at 03:43:17PM -0000, Fridtjof Busse wrote:
> A Nessus-logfile is not really helpful, especially as most of the problems found have already been fixed with USN-455-1.
> Nonetheless, is anybody working on this?

There are a few issues that are in the 5.2.2 update that are "new"
issues (i.e. not from the MOPB), which will be incorporated into another
php5 update. I've got this on my todo list, but if someone else can
prepare a patch again our current php5, I would be happy to get it. :)

--
Kees Cook @outflux.net

[Jim Tarvid (tarvid)]

http://www.securityfocus.com/bid/23145

[Ante Karamatić (ivoks)]

Jim, CVE-2007-1718 was fixed with USN-455-1 on April, 23.

[Kees Cook (kees)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. This problem has been addressed with the following USN:

http://www.ubuntu.com/usn/usn-462-1

Please feel free to report future bugs.

[Kees Cook (kees)]

Note that CVE-2007-1001 does not apply to Ubuntu (or Debian's) because Ubuntu's PHP links against the system libgd2, which is not vulnerable.