UPDATE REQUEST: php53u 5.3.10 is available upstream
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
| IUS Community Project |
Undecided
|
Unassigned | ||
| php5 (Ubuntu) |
Undecided
|
Unassigned |
Bug Description
New Source from Upstream: http://
Jeffrey Ness (jeffrey-ness) wrote : | #1 |
Jeffrey Ness (jeffrey-ness) wrote : | #2 |
Builds are complete and will be pushed in to stable at next sync (tonight).
Changed in ius: | |
status: | New → Fix Released |
Launchpad Janitor (janitor) wrote : | #3 |
This bug was fixed in the package php5 - 5.3.6-13ubuntu3.5
---------------
php5 (5.3.6-13ubuntu3.5) oneiric-security; urgency=low
* SECURITY UPDATE: memory allocation failure denial of service
- debian/
zend_strdup() and calloc() for failed allocations
- CVE-2011-4153
* SECURITY UPDATE: predictable hash collision denial of service
(LP: #910296)
- debian/
directive with default limit of 1000
- ATTENTION: this update changes previous php5 behavior by
limiting the number of external input variables to 1000.
This may be increased by adding a "max_input_vars"
directive to the php.ini configuration file. See
http://
for more information.
- CVE-2011-4885
* SECURITY UPDATE: remote code execution vulnerability introduced by
the fix for CVE-2011-4885 (LP: #925772)
- debian/
continuing if max_input_vars limit is reached
- CVE-2012-0830
* SECURITY UPDATE: XSLT arbitrary file overwrite attack
- debian/
ini option to define forbidden operations within XSLT stylesheets
- CVE-2012-0057
* SECURITY UPDATE: PDORow session denial of service
- debian/
attempting to serialize PDORow instances
- CVE-2012-0788
* SECURITY UPDATE: magic_quotes_gpc remote disable vulnerability
- debian/
magic_
- CVE-2012-0831
-- Steve Beattie <email address hidden> Wed, 08 Feb 2012 20:56:28 -0800
Changed in php5 (Ubuntu): | |
status: | New → Fix Released |
5.3.10 Address CVE-2012-0830
http:// www.php. net/ChangeLog- 5.php#5. 3.10
Working on some builds as we speak.