LWN.net Logo

Not logged in

Log in now

Create an account

Subscribe to LWN

Recent Features

LWN.net Weekly Edition for May 16, 2013

A look at the PyPy 2.0 release

PostgreSQL 9.3 beta: Federated databases and more

LWN.net Weekly Edition for May 9, 2013

(Nearly) full tickless operation in 3.10

Printable page
Weekly edition Kernel Security Distributions Contact Us Search
Archives Calendar Subscribe Write for LWN LWN.net FAQ Sponsors

openSUSE alert openSUSE-SU-2010:1012-1 (php5)



From:
    	      opensuse-security@opensuse.org 


To:
    	      opensuse-updates@opensuse.org 


Subject:
    	      openSUSE-SU-2010:1012-1 (moderate): php5 security update for CVE-2010-3870 and CVE-2010-3710 


Date:
    	      Thu,  2 Dec 2010 17:08:13 +0100 (CET)


Message-ID:
    	      <20101202160813.A4CFDBE64@oldboy.suse.de>


Archive-link:
    	      Article, Thread
              


   openSUSE Security Update: php5 security update for CVE-2010-3870 and CVE-2010-3710
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2010:1012-1
Rating:             moderate
References:         #650700 
Cross-References:   CVE-2010-3710 CVE-2010-3870
Affected Products:
                    openSUSE 11.3
                    openSUSE 11.2
                    openSUSE 11.1
______________________________________________________________________________

   An update that fixes two vulnerabilities is now available.
   It includes two new package versions.

Description:

   Insufficient handling of certain character sequences in the
   utf8_decode() function could be leveraged to conduct
   cross-site-scripting (XSS) attacks  (CVE-2010-3870). php5
   could also consume large amounts of memory and crash if a
   long mail address was passed to filter_var() with parmeter
   FILTER_VALIDATE_EMAIL (CVE-2010-3710).


Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - openSUSE 11.3:

      zypper in -t patch apache2-mod_php5-3485

   - openSUSE 11.2:

      zypper in -t patch apache2-mod_php5-3485

   - openSUSE 11.1:

      zypper in -t patch apache2-mod_php5-3485

   To bring your system up-to-date, use "zypper patch".


Package List:

   - openSUSE 11.3 (i586 x86_64) [New Version: 5.3.3]:

      apache2-mod_php5-5.3.3-0.7.1
      php5-5.3.3-0.7.1
      php5-bcmath-5.3.3-0.7.1
      php5-bz2-5.3.3-0.7.1
      php5-calendar-5.3.3-0.7.1
      php5-ctype-5.3.3-0.7.1
      php5-curl-5.3.3-0.7.1
      php5-dba-5.3.3-0.7.1
      php5-devel-5.3.3-0.7.1
      php5-dom-5.3.3-0.7.1
      php5-enchant-5.3.3-0.7.1
      php5-exif-5.3.3-0.7.1
      php5-fastcgi-5.3.3-0.7.1
      php5-fileinfo-5.3.3-0.7.1
      php5-ftp-5.3.3-0.7.1
      php5-gd-5.3.3-0.7.1
      php5-gettext-5.3.3-0.7.1
      php5-gmp-5.3.3-0.7.1
      php5-hash-5.3.3-0.7.1
      php5-iconv-5.3.3-0.7.1
      php5-imap-5.3.3-0.7.1
      php5-intl-5.3.3-0.7.1
      php5-json-5.3.3-0.7.1
      php5-ldap-5.3.3-0.7.1
      php5-mbstring-5.3.3-0.7.1
      php5-mcrypt-5.3.3-0.7.1
      php5-mysql-5.3.3-0.7.1
      php5-odbc-5.3.3-0.7.1
      php5-openssl-5.3.3-0.7.1
      php5-pcntl-5.3.3-0.7.1
      php5-pdo-5.3.3-0.7.1
      php5-pgsql-5.3.3-0.7.1
      php5-phar-5.3.3-0.7.1
      php5-posix-5.3.3-0.7.1
      php5-pspell-5.3.3-0.7.1
      php5-readline-5.3.3-0.7.1
      php5-shmop-5.3.3-0.7.1
      php5-snmp-5.3.3-0.7.1
      php5-soap-5.3.3-0.7.1
      php5-sockets-5.3.3-0.7.1
      php5-sqlite-5.3.3-0.7.1
      php5-suhosin-5.3.3-0.7.1
      php5-sysvmsg-5.3.3-0.7.1
      php5-sysvsem-5.3.3-0.7.1
      php5-sysvshm-5.3.3-0.7.1
      php5-tidy-5.3.3-0.7.1
      php5-tokenizer-5.3.3-0.7.1
      php5-wddx-5.3.3-0.7.1
      php5-xmlreader-5.3.3-0.7.1
      php5-xmlrpc-5.3.3-0.7.1
      php5-xmlwriter-5.3.3-0.7.1
      php5-xsl-5.3.3-0.7.1
      php5-zip-5.3.3-0.7.1
      php5-zlib-5.3.3-0.7.1

   - openSUSE 11.3 (noarch) [New Version: 5.3.3]:

      php5-pear-5.3.3-0.7.1

   - openSUSE 11.2 (i586 x86_64) [New Version: 5.3.3]:

      apache2-mod_php5-5.3.3-0.7.1
      php5-5.3.3-0.7.1
      php5-bcmath-5.3.3-0.7.1
      php5-bz2-5.3.3-0.7.1
      php5-calendar-5.3.3-0.7.1
      php5-ctype-5.3.3-0.7.1
      php5-curl-5.3.3-0.7.1
      php5-dba-5.3.3-0.7.1
      php5-devel-5.3.3-0.7.1
      php5-dom-5.3.3-0.7.1
      php5-enchant-5.3.3-0.7.1
      php5-exif-5.3.3-0.7.1
      php5-fastcgi-5.3.3-0.7.1
      php5-fileinfo-5.3.3-0.7.1
      php5-ftp-5.3.3-0.7.1
      php5-gd-5.3.3-0.7.1
      php5-gettext-5.3.3-0.7.1
      php5-gmp-5.3.3-0.7.1
      php5-hash-5.3.3-0.7.1
      php5-iconv-5.3.3-0.7.1
      php5-imap-5.3.3-0.7.1
      php5-intl-5.3.3-0.7.1
      php5-json-5.3.3-0.7.1
      php5-ldap-5.3.3-0.7.1
      php5-mbstring-5.3.3-0.7.1
      php5-mcrypt-5.3.3-0.7.1
      php5-mysql-5.3.3-0.7.1
      php5-odbc-5.3.3-0.7.1
      php5-openssl-5.3.3-0.7.1
      php5-pcntl-5.3.3-0.7.1
      php5-pdo-5.3.3-0.7.1
      php5-pgsql-5.3.3-0.7.1
      php5-phar-5.3.3-0.7.1
      php5-posix-5.3.3-0.7.1
      php5-pspell-5.3.3-0.7.1
      php5-readline-5.3.3-0.7.1
      php5-shmop-5.3.3-0.7.1
      php5-snmp-5.3.3-0.7.1
      php5-soap-5.3.3-0.7.1
      php5-sockets-5.3.3-0.7.1
      php5-sqlite-5.3.3-0.7.1
      php5-suhosin-5.3.3-0.7.1
      php5-sysvmsg-5.3.3-0.7.1
      php5-sysvsem-5.3.3-0.7.1
      php5-sysvshm-5.3.3-0.7.1
      php5-tidy-5.3.3-0.7.1
      php5-tokenizer-5.3.3-0.7.1
      php5-wddx-5.3.3-0.7.1
      php5-xmlreader-5.3.3-0.7.1
      php5-xmlrpc-5.3.3-0.7.1
      php5-xmlwriter-5.3.3-0.7.1
      php5-xsl-5.3.3-0.7.1
      php5-zip-5.3.3-0.7.1
      php5-zlib-5.3.3-0.7.1

   - openSUSE 11.2 (noarch) [New Version: 5.3.3]:

      php5-pear-5.3.3-0.7.1

   - openSUSE 11.1 (i586 ppc x86_64) [New Version: 5.2.14]:

      apache2-mod_php5-5.2.14-0.4.1
      php5-5.2.14-0.4.1
      php5-bcmath-5.2.14-0.4.1
      php5-bz2-5.2.14-0.4.1
      php5-calendar-5.2.14-0.4.1
      php5-ctype-5.2.14-0.4.1
      php5-curl-5.2.14-0.4.1
      php5-dba-5.2.14-0.4.1
      php5-dbase-5.2.14-0.4.1
      php5-devel-5.2.14-0.4.1
      php5-dom-5.2.14-0.4.1
      php5-exif-5.2.14-0.4.1
      php5-fastcgi-5.2.14-0.4.1
      php5-ftp-5.2.14-0.4.1
      php5-gd-5.2.14-0.4.1
      php5-gettext-5.2.14-0.4.1
      php5-gmp-5.2.14-0.4.1
      php5-hash-5.2.14-0.4.1
      php5-iconv-5.2.14-0.4.1
      php5-imap-5.2.14-0.4.1
      php5-json-5.2.14-0.4.1
      php5-ldap-5.2.14-0.4.1
      php5-mbstring-5.2.14-0.4.1
      php5-mcrypt-5.2.14-0.4.1
      php5-mysql-5.2.14-0.4.1
      php5-ncurses-5.2.14-0.4.1
      php5-odbc-5.2.14-0.4.1
      php5-openssl-5.2.14-0.4.1
      php5-pcntl-5.2.14-0.4.1
      php5-pdo-5.2.14-0.4.1
      php5-pear-5.2.14-0.4.1
      php5-pgsql-5.2.14-0.4.1
      php5-posix-5.2.14-0.4.1
      php5-pspell-5.2.14-0.4.1
      php5-readline-5.2.14-0.4.1
      php5-shmop-5.2.14-0.4.1
      php5-snmp-5.2.14-0.4.1
      php5-soap-5.2.14-0.4.1
      php5-sockets-5.2.14-0.4.1
      php5-sqlite-5.2.14-0.4.1
      php5-suhosin-5.2.14-0.4.1
      php5-sysvmsg-5.2.14-0.4.1
      php5-sysvsem-5.2.14-0.4.1
      php5-sysvshm-5.2.14-0.4.1
      php5-tidy-5.2.14-0.4.1
      php5-tokenizer-5.2.14-0.4.1
      php5-wddx-5.2.14-0.4.1
      php5-xmlreader-5.2.14-0.4.1
      php5-xmlrpc-5.2.14-0.4.1
      php5-xmlwriter-5.2.14-0.4.1
      php5-xsl-5.2.14-0.4.1
      php5-zip-5.2.14-0.4.1
      php5-zlib-5.2.14-0.4.1


References:

   http://support.novell.com/security/cve/CVE-2010-3710.html
   http://support.novell.com/security/cve/CVE-2010-3870.html
   https://bugzilla.novell.com/650700
(Log in to post comments)

Copyright © 2013, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds