* SECURITY UPDATE: HTTP response-splitting issue with %0D sequences
- debian/patches/CVE-2011-1398.patch: properly handle %0D and NUL in
main/SAPI.c, added tests to ext/standard/tests/*, fix test suite
failures in ext/phar/phar_object.c.
- CVE-2011-1398
- CVE-2012-4388
* SECURITY UPDATE: denial of service and possible code execution via
_php_stream_scandir function (LP: #1028064)
- debian/patches/CVE-2012-2688.patch: prevent overflow in
main/streams/streams.c.
- CVE-2012-2688
* SECURITY UPDATE: denial of service via PDO extension crafted parameter
- debian/patches/CVE-2012-3450.patch: improve logic in
ext/pdo/pdo_sql_parser.re, regenerate ext/pdo/pdo_sql_parser.c, add
test to ext/pdo_mysql/tests/bug_61755.phpt.
- CVE-2012-3450
-- Marc Deslauriers <email address hidden> Wed, 12 Sep 2012 09:09:05 -0400
This bug was fixed in the package php5 - 5.3.6-13ubuntu3.9
---------------
php5 (5.3.6-13ubuntu3.9) oneiric-security; urgency=low
* SECURITY UPDATE: HTTP response-splitting issue with %0D sequences patches/ CVE-2011- 1398.patch: properly handle %0D and NUL in tests/* , fix test suite phar_object. c. stream_ scandir function (LP: #1028064) patches/ CVE-2012- 2688.patch: prevent overflow in streams/ streams. c. patches/ CVE-2012- 3450.patch: improve logic in pdo/pdo_ sql_parser. re, regenerate ext/pdo/ pdo_sql_ parser. c, add mysql/tests/ bug_61755. phpt.
- debian/
main/SAPI.c, added tests to ext/standard/
failures in ext/phar/
- CVE-2011-1398
- CVE-2012-4388
* SECURITY UPDATE: denial of service and possible code execution via
_php_
- debian/
main/
- CVE-2012-2688
* SECURITY UPDATE: denial of service via PDO extension crafted parameter
- debian/
ext/
test to ext/pdo_
- CVE-2012-3450
-- Marc Deslauriers <email address hidden> Wed, 12 Sep 2012 09:09:05 -0400