php5 5.0.5-2ubuntu1.3 source package in Ubuntu

Changelog

php5 (5.0.5-2ubuntu1.3) breezy-security; urgency=low

  * SECURITY UPDATE: Multiple vulnerabilities.
  * debian/patches/CVE-2006-0996.patch:
    - XSS in phpinfo() [CVE-2006-0996]
    - http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/info.c?r1=1.260&r2=1.261
  * debian/patches/CVE-2006-1490.patch:
    - Memory disclosure in html_entity_decode() [CVE-2006-1490]
    - http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/html.c?r1=1.112&r2=1.113
  * debian/patches/CVE-2006-1494.patch:
    - Bypassing open_basedir restrictions with tempnam()
      [CVE-2006-1494, CVE-2006-2660]
    - http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/file.c?r1=1.279.2.70.2.4&r2=1.279.2.70.2.5
  * debian/patches/CVE-2006-1608.patch:
    - Bypassing open_basedir restrictions with copy() via a source argument
      containing a compress.zlib:// URI [CVE-2006-1494]
    - http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/file.c?r1=1.382.2.10&r2=1.382.2.11
  * debian/patches/CVE-2006-1990.patch:
    - Integer overflow in wordwrap function (usually not triggerable from
      outside). [CVE-2006-1990]
    - Zend/zend_alloc.c: Fix variable declaration to work on 64-bit systems to
      plug this vulnerability on amd64/ia64, too. (not yet fixed upstream)
  * debian/patches/CVE-2006-1991.patch:
    - DoS with out-of-bounds offset argument to substr_compare()
      [CVE-2006-1991]
  * debian/patches/CVE-2006-2563.patch:
    - Bypassing safe mode/open_basedir restrictions with curl module
      [CVE-2006-2563]
    - Patch taken from Mandriva, not fixed upstream.
  * debian/patches/CVE-2006-3011.patch:
    - Bypassing safe mode/open_basedir restrictions with error_log() with
      'php://' or other schema in the third argument. [CVE-2006-3011]
    - http://cvs.php.net/viewvc.cgi/php-src/ext/standard/basic_functions.c?r1=1.543.2.51.2.9&r2=1.543.2.51.2.10
  * debian/patches/CVE-2006-3017.patch:
    - Fix zend_hash_del() (previously could delete the wrong element, which
      prevented a variable from being unset even when the PHP unset function
      was called, which might cause the variable's value to be used in
      security-relevant operations). [CVE-2006-3017]
    - http://cvs.php.net/viewcvs.cgi/Zend/zend_hash.c?r1=1.87.4.8.2.1&r2=1.87.4.8.2.3
  * debian/patches/CVE-2006-3018.patch:
    - Heap corruption in session extension. [CVE-2006-3018]
    - http://cvs.php.net/viewcvs.cgi/php-src/ext/session/mod_files.c?r1=1.102&r2=1.103
  * Note: This version already has the fix for CVE-2006-3016 (Check session
    name for invalid characters to prevent CRLF and other malicious
    injections.)

 -- Martin Pitt <email address hidden>   Tue, 18 Jul 2006 21:32:03 +0000