[php5] [CVE-2007-4887] possible denial of service

[disabled.user]

Binary package hint: php5

References:
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4887
[2] http://www.php.net/releases/5_2_5.php

From [1]:
"The dl function in PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long string in the library parameter. NOTE: there are limited usage scenarios under which this would be a vulnerability."

[Kees Cook (kees)]

Thanks for the report. This CVE is not considered a real security issue since it is just a script-author-local crash of a PHP instance without evidence of controllable memory corruption.

[Michael Lueck (mlueck)]

Since Hardy 8.04 is going to be a LTS release, I find it odd that Ubuntu has not moved to the 5.2.5 version which per www.php.net was released back on 08-Nov-2007.

Could someone please shed some light on this point? Thanks!

[Jamie Strandboge (jdstrand)]

Per the ubuntu-cve-tracker: this is a local php instance crasher, not a serious security issue. We do not plan to fix this in Ubuntu.