Bug 1117 - PHP Multiple vulnerability
Summary: PHP Multiple vulnerability
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: Cauldron
Hardware: i586 Linux
Priority: Normal critical
Target Milestone: ---
Assignee: Mageia Bug Squad
QA Contact:
URL: http://www.ubuntu.com/usn/usn-1126-1/
Whiteboard:
Keywords:
Depends on:
Blocks: 908
  Show dependency tree / graph
 
Reported: 2011-05-03 14:21 CEST by Michael Scherer
Modified: 2011-05-18 23:43 CEST (History)
3 users (show)

See Also:
Source RPM: php
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Michael Scherer 2011-05-03 14:21:47 CEST 
Php suffer from multiple vulnerabilities : 
http://www.ubuntu.com/usn/usn-1126-1/
Michael Scherer 2011-05-03 14:22:02 CEST

Blocks: (none) => 908

Michael Scherer 2011-05-05 15:39:31 CEST

Summary: Multiple vulnerability => PHP Multiple vulnerability

Comment 1 Michael Scherer 2011-05-05 15:39:48 CEST 
According to saispo, there is some regression caused by this security update
Comment 2 Michael Scherer 2011-05-17 16:34:20 CEST 
Saispo, you have more information about the regression caused by this ?

CC: (none) => misc, saispo

Comment 3 Michael Scherer 2011-05-17 16:35:26 CEST 
Ok, regression seems to have been fixed : http://www.ubuntu.com/usn/usn-1126-2/

So I guess we can update php ?
Comment 4 Pascal Terjan 2011-05-18 21:16:41 CEST 
Several of them were already fixed by http://svnweb.mageia.org/packages?view=revision&revision=87292

- Update to 5.3.6
  - Fixes CVE-2011-1153, CVE-2011-1092, CVE-2011-0708, CVE-2011-0421
  - Sync with Mandriva

CC: (none) => pterjan

Comment 5 Pascal Terjan 2011-05-18 21:34:24 CEST 
From the CVE listed in that Ubuntu advisory:

CVE-2006-7243 Fixed in 5.3.4
CVE-2010-4697 Fixed in 5.3.4
CVE-2010-4698 Fixed in 5.3.4
CVE-2011-0420 
CVE-2011-0421 Fixed in 5.3.6
CVE-2011-0441 
CVE-2011-0708 Fixed in 5.3.6
CVE-2011-1092 Fixed in 5.3.6
CVE-2011-1144 
CVE-2011-1148 
CVE-2011-1153 Fixed in 5.3.6
CVE-2011-1464 Fixed in 5.3.6
CVE-2011-1466 Fixed in 5.3.6
CVE-2011-1467 Fixed in 5.3.6
CVE-2011-1468 Fixed in 5.3.6
CVE-2011-1469 Fixed in 5.3.6
CVE-2011-1470 Fixed in 5.3.6
CVE-2011-1471 Fixed in 5.3.6

So CVE-2011-0420, CVE-2011-0441, CVE-2011-1144 and CVE-2011-1148 need to be checked
Comment 6 Pascal Terjan 2011-05-18 23:15:33 CEST 
CVE-2011-0420 Not a security issue according to https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-0420
Comment 7 Pascal Terjan 2011-05-18 23:22:27 CEST 
We already have the fix for CVE-2011-0441
Comment 8 Pascal Terjan 2011-05-18 23:25:35 CEST 
Fix for CVE-2011-1148
http://svn.php.net/viewvc?view=revision&revision=310194
Comment 9 Pascal Terjan 2011-05-18 23:28:29 CEST 
CVE-2011-1144 is for php-pear, not php
Comment 10 Pascal Terjan 2011-05-18 23:33:41 CEST 
Fix for CVE-2011-1148 added to php package.
Comment 11 Pascal Terjan 2011-05-18 23:43:54 CEST 
Fix for CVE-2011-1144 added to php-pear package.

Status: NEW => RESOLVED
Resolution: (none) => FIXED
Note You need to log in before you can comment on or make changes to this bug.