* SECURITY UPDATE: memory allocation failure denial of service
- debian/patches/php5-CVE-2011-4153.patch: check result of
zend_strdup() and calloc() for failed allocations
- CVE-2011-4153
* SECURITY UPDATE: predictable hash collision denial of service
(LP: #910296)
- debian/patches/php5-CVE-2011-4885.patch: add max_input_vars
directive with default limit of 1000
- ATTENTION: this update changes previous php5 behavior by
limiting the number of external input variables to 1000.
This may be increased by adding a "max_input_vars"
directive to the php.ini configuration file. See http://www.php.net/manual/en/info.configuration.php#ini.max-input-vars
for more information.
- CVE-2011-4885
* SECURITY UPDATE: remote code execution vulnerability introduced by
the fix for CVE-2011-4885 (LP: #925772)
- debian/patches/php5-CVE-2012-0830.patch: return rather than
continuing if max_input_vars limit is reached
- CVE-2012-0830
* SECURITY UPDATE: XSLT arbitrary file overwrite attack
- debian/patches/php5-CVE-2012-0057.patch: add xsl.security_prefs
ini option to define forbidden operations within XSLT stylesheets
- CVE-2012-0057
* SECURITY UPDATE: PDORow session denial of service
- debian/patches/php5-CVE-2012-0788.patch: fail gracefully when
attempting to serialize PDORow instances
- CVE-2012-0788
* SECURITY UPDATE: magic_quotes_gpc remote disable vulnerability
- debian/patches/php5-CVE-2012-0831.patch: always restore
magic_quote_gpc on request shutdown
- CVE-2012-0831
-- Steve Beattie <email address hidden> Wed, 08 Feb 2012 20:58:41 -0800
This bug was fixed in the package php5 - 5.3.5-1ubuntu7.6
---------------
php5 (5.3.5-1ubuntu7.6) natty-security; urgency=low
* SECURITY UPDATE: memory allocation failure denial of service patches/ php5-CVE- 2011-4153. patch: check result of patches/ php5-CVE- 2011-4885. patch: add max_input_vars www.php. net/manual/ en/info. configuration. php#ini. max-input- vars patches/ php5-CVE- 2012-0830. patch: return rather than patches/ php5-CVE- 2012-0057. patch: add xsl.security_prefs patches/ php5-CVE- 2012-0788. patch: fail gracefully when patches/ php5-CVE- 2012-0831. patch: always restore quote_gpc on request shutdown
- debian/
zend_strdup() and calloc() for failed allocations
- CVE-2011-4153
* SECURITY UPDATE: predictable hash collision denial of service
(LP: #910296)
- debian/
directive with default limit of 1000
- ATTENTION: this update changes previous php5 behavior by
limiting the number of external input variables to 1000.
This may be increased by adding a "max_input_vars"
directive to the php.ini configuration file. See
http://
for more information.
- CVE-2011-4885
* SECURITY UPDATE: remote code execution vulnerability introduced by
the fix for CVE-2011-4885 (LP: #925772)
- debian/
continuing if max_input_vars limit is reached
- CVE-2012-0830
* SECURITY UPDATE: XSLT arbitrary file overwrite attack
- debian/
ini option to define forbidden operations within XSLT stylesheets
- CVE-2012-0057
* SECURITY UPDATE: PDORow session denial of service
- debian/
attempting to serialize PDORow instances
- CVE-2012-0788
* SECURITY UPDATE: magic_quotes_gpc remote disable vulnerability
- debian/
magic_
- CVE-2012-0831
-- Steve Beattie <email address hidden> Wed, 08 Feb 2012 20:58:41 -0800