php5 5.0.5-2ubuntu1.5 source package in Ubuntu

Changelog

php5 (5.0.5-2ubuntu1.5) breezy-security; urgency=low

  * SECURITY UPDATE: Multiple vulnerabilities.
  * Fix CVE number in 5.1.2-1ubuntu3.1 changelog: The curl open_basedir
    bypass is actually CVE-2006-4483, not -2563.
  * Add debian/patches/CVE-2006-4485.patch:
    - Fix buffer overread in stripos().
    - Ported from upstream CVS:
      http://cvs.php.net/viewvc.cgi/php-src/ext/standard/string.c?view=diff&r1=1.547&r2=1.548
  * Add debian/patches/CVE-2006-4486.patch:
    - Fix integer overflow and memory_limit bypass on 64 bit platforms.
    - Patch stolen from RedHat security update, not fixed upstream yet.
  * Add debian/patches/CVE-2006-4625.patch:
    - Fix open_basedir/safe_mode bypass with ini_restore().
    - Ported from upstream CVS:
      http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_ini.c?r1=1.39.2.2&r2=1.39.2.3
  * Add debian/patches/CVE-2006-4812.patch:
    - Fix integer overflow in Zend's ecalloc().
    - Ported from upstream CVS:
      http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_alloc.c?r1=1.161&r2=1.162
  * Note for CVE tracking: This version is not vulnerable to CVE-2006-0200.

 -- Martin Pitt <email address hidden>   Tue, 10 Oct 2006 13:29:05 +0000