Ubuntu
php4 package

  1. Bug #11223
  2. Comment #7

Comment 7 for bug 11223

Revision history for this message
In , Martin Schulze (joey-infodrom) wrote : Re: [PATCH,RFC] Backport of PHP 4.3.9 security fixes: pack()/unpack()

Hans Kratz wrote:
> Hi!
>
> I am not a Debian developer but we use Woody on our servers. The
> latest PHP security holes affect us as well. I have backported the
> security fix for the pack()/unpack() functions (attached).
>
> Attached patch is against PHP 4.1.2-7. PHP 4.1.2-7+patch builds fine
> in a Woody pbuilder and looks ok but I have not yet otherwise tested
> it.
>
> Comments? Should I try to backport the other security fixes as well?

If you discover real security issues, yes please, or at least get
in touch with us so we don't miss it accidently.

You can only exploit the bug for which you provided a backport (didn't
the patch apply well?) if you write a malicious php script.
That's not an issue. You can do more with a malicious php script
with less effort.

Regards,

 Joey

--
All language designers are arrogant. Goes with the territory...
 -- Larry Wall