Bug 16349

In VirtualBox, M4, KDE, 32-bit

Install and setup mariadb
In root terminal: systemctl start mysqld.service
Set password to: testphp
[root@localhost wilcal]# mysqladmin -u root password
type password "testphp" twice

Package(s) under test:
php-ini php-fpm owncloud drupal phpmyadmin

default install of php-ini php-fpm drupal glpi owncloud phpmyadmin

[root@localhost wilcal]# urpmi php-ini
Package php-ini-5.5.26-1.mga4.i586 is already installed
[root@localhost wilcal]# urpmi php-fpm
Package php-fpm-5.5.26-1.mga4.i586 is already installed
[root@localhost wilcal]# urpmi owncloud
Package owncloud-6.0.7-1.mga4.noarch is already installed
[root@localhost wilcal]# urpmi drupal
Package drupal-7.38-1.mga4.noarch is already installed
[root@localhost wilcal]# urpmi phpmyadmin
Package phpmyadmin-4.2.13.3-1.mga4.noarch is already installed

localhost/owncloud opens and runs
localhost/drupal opens and runs
localhost/phpmyadmin opens, runs and creates a database named "test"

install package from updates_testing

[root@localhost wilcal]# urpmi php-ini
Package php-ini-5.5.27-1.mga4.i586 is already installed
[root@localhost wilcal]# urpmi php-fpm
Package php-fpm-5.5.27-1.mga4.i586 is already installed
[root@localhost wilcal]# urpmi owncloud
Package owncloud-6.0.7-1.mga4.noarch is already installed
[root@localhost wilcal]# urpmi drupal
Package drupal-7.38-1.mga4.noarch is already installed
[root@localhost wilcal]# urpmi phpmyadmin
Package phpmyadmin-4.2.13.3-1.mga4.noarch is already installed

localhost/owncloud opens and runs
localhost/drupal opens and runs
localhost/phpmyadmin opens, runs and creates a database named "testagain"

Test platform:
Intel Core i7-2600K Sandy Bridge 3.4GHz
GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo
GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB
RTL8111/8168B PCI Express 1Gbit Ethernet
DRAM 16GB (4 x 4GB)
Mageia 4 64-bit, Nvidia driver
virtualbox-4.3.26-1.mga4.x86_64
virtualbox-guest-additions-4.3.26-1.mga4.x86_64

CC: (none) => wilcal.int

In VirtualBox, M4, KDE, 64-bit

Install and setup mariadb
In root terminal: systemctl start mysqld.service
Set password to: testphp
[root@localhost wilcal]# mysqladmin -u root password
type password "testphp" twice

Package(s) under test:
php-ini php-fpm drupal phpmyadmin

default install of php-ini php-fpm drupal phpmyadmin

[root@localhost wilcal]# urpmi php-ini
Package php-ini-5.5.26-1.mga4.x86_64 is already installed
[root@localhost wilcal]# urpmi php-fpm
Package php-fpm-5.5.26-1.mga4.x86_64 is already installed
[root@localhost wilcal]# urpmi drupal
Package drupal-7.38-1.mga4.noarch is already installed
[root@localhost wilcal]# urpmi phpmyadmin
Package phpmyadmin-4.2.13.3-1.mga4.noarch is already installed

localhost/drupal opens and runs
localhost/phpmyadmin opens, runs and creates a database named "test"

install package from updates_testing

[root@localhost wilcal]# urpmi php-ini
Package php-ini-5.5.27-1.mga4.x86_64 is already installed
[root@localhost wilcal]# urpmi php-fpm
Package php-fpm-5.5.27-1.mga4.x86_64 is already installed
[root@localhost wilcal]# urpmi drupal
Package drupal-7.38-1.mga4.noarch is already installed
[root@localhost wilcal]# urpmi phpmyadmin
Package phpmyadmin-4.2.13.3-1.mga4.noarch is already installed

localhost/drupal opens and runs
localhost/phpmyadmin opens, runs and creates a database named "testagain"

Test platform:
Intel Core i7-2600K Sandy Bridge 3.4GHz
GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo
GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB
RTL8111/8168B PCI Express 1Gbit Ethernet
DRAM 16GB (4 x 4GB)
Mageia 4 64-bit, Nvidia driver
virtualbox-4.3.26-1.mga4.x86_64
virtualbox-guest-additions-4.3.26-1.mga4.x86_64

CVE-2015-5589 and CVE-2015-5590 have been assigned to the phar issues fixed here:
http://openwall.com/lists/oss-security/2015/07/18/1

Testing MGA4 x64

Updated all applicable PHP modules in Updates Testing to 5.5.27-1.
Played with:
- phpmyadmin
- phppgadmin
- Drupal
- Moodle
- MediaWiki
- Cacti [relevant ?]
Nothing untoward noticed. OK as far as I am concerned; but needs more tests by others to formalise this.

CC: (none) => lewyssmith

I played with various PHP webapps myself while testing apache, mga 4 64 too but I consider it enough to validate the update (and hasn't PHP a testsuite included?)

Keywords: (none) => validated_update
Whiteboard: (none) => MGA4-64-OK
CC: (none) => sysadmin-bugs

(In reply to Samuel VERSCHELDE from comment #5)
> I played with various PHP webapps myself while testing apache, mga 4 64 too
> but I consider it enough to validate the update (and hasn't PHP a testsuite
> included?)

It does indeed have an extensive build-time test suite, which we do run.  I don't know if we've ever rejected a PHP update because it broke something.  The only issue I can remember running into are PoCs that weren't fully fixed.

Here's an advisory for now.  An inquiry was made about the CVE that should be used for php-mysqlnd's version of the BACKRONYM flaw, but it hasn't been answered yet.

Advisory:
========================

Updated php packages fix security vulnerabilities:

Segfault in Phar::convertToData on invalid file (CVE-2015-5589).

Buffer overflow and stack smashing error in phar_fix_filepath (CVE-2015-5590).

The php package has been updated to version 5.5.27, which fixes these issues,
as well as other possible bugs and security issues, including the BACKRONYM
flaw, which allows php-mysqlnd client connections that were supposed to use
SSL/TLS to be downgraded to not use it.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5589
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5590
http://php.net/ChangeLog-5.php#5.5.27
http://openwall.com/lists/oss-security/2015/07/18/1

An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2015-0276.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED