User: Password:
|
|
Subscribe / Log in / New account

Mandriva alert MDVSA-2014:075 (php)

From:  security@mandriva.com
To:  security-announce@lists.mandriva.com
Subject:  [Security Announce] [ MDVSA-2014:075 ] php
Date:  Thu, 10 Apr 2014 15:25:00 +0200
Message-ID:  <E1WYEyS-00029P-Q8@titan.mandriva.com>

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2014:075 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : php Date : April 10, 2014 Affected: Business Server 1.0 _______________________________________________________________________ Problem Description: A vulnerability has been discovered and corrected in php: The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters (CVE-2013-7345). The updated php packages have been upgraded to the 5.5.11 version which is not vulnerable to this issue. Also, the timezonedb PHP PECL module has been updated to the latest 2014.2 version. Additionally, the PECL packages which requires so has been rebuilt for php-5.5.11. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7345 http://www.php.net/ChangeLog-5.php#5.5.11 https://bugs.php.net/bug.php?id=66946 http://pecl.php.net/package-info.php?package=timezonedb&... _______________________________________________________________________ Updated Packages: Mandriva Business Server 1/X86_64: 16ed2fc09e90bc53fb06ed816c0fa140 mbs1/x86_64/apache-mod_php-5.5.11-1.mbs1.x86_64.rpm 36102c1cf2dd9869991e297ad0de02d7 mbs1/x86_64/lib64php5_common5-5.5.11-1.mbs1.x86_64.rpm 939f614b9ff6253542f9951aa503df73 mbs1/x86_64/php-apc-3.1.15-1.5.mbs1.x86_64.rpm 4f12b8911a81d72c0d00af50dd8d764a mbs1/x86_64/php-apc-admin-3.1.15-1.5.mbs1.x86_64.rpm d643d3ba3067aa3ce7502b409b887283 mbs1/x86_64/php-bcmath-5.5.11-1.mbs1.x86_64.rpm b65cfcc605007fb8fa524e958f4f7646 mbs1/x86_64/php-bz2-5.5.11-1.mbs1.x86_64.rpm f6c8aa5157487d7cafc752bcde0ac390 mbs1/x86_64/php-calendar-5.5.11-1.mbs1.x86_64.rpm 86895019ad8f973e2d760557e5cd4986 mbs1/x86_64/php-cgi-5.5.11-1.mbs1.x86_64.rpm 92bf2522d78186cdfa57409c4b8aacdd mbs1/x86_64/php-cli-5.5.11-1.mbs1.x86_64.rpm bb8389d66cec38bf60a5d9e8a83a5c89 mbs1/x86_64/php-ctype-5.5.11-1.mbs1.x86_64.rpm 91612ba52d438038fb2efc780e8fc918 mbs1/x86_64/php-curl-5.5.11-1.mbs1.x86_64.rpm 7d7add6de1cbfc494a958250a8f97e52 mbs1/x86_64/php-dba-5.5.11-1.mbs1.x86_64.rpm 641b990d90ce503aa4421ad30adc54b5 mbs1/x86_64/php-devel-5.5.11-1.mbs1.x86_64.rpm b2ecf1be2db26609a6cd55235a7b8ccd mbs1/x86_64/php-doc-5.5.11-1.mbs1.noarch.rpm a975c4eef72a1845ba97a949714e6762 mbs1/x86_64/php-dom-5.5.11-1.mbs1.x86_64.rpm 10f18783c79266ee5568094a28a2ba5a mbs1/x86_64/php-enchant-5.5.11-1.mbs1.x86_64.rpm 0332e38cb7cec951b6981fcb999fd70e mbs1/x86_64/php-exif-5.5.11-1.mbs1.x86_64.rpm 1b283db4e724dab5df823d167fb83d9a mbs1/x86_64/php-fileinfo-5.5.11-1.mbs1.x86_64.rpm 14035bdf19fb27800279594087f1d02b mbs1/x86_64/php-filter-5.5.11-1.mbs1.x86_64.rpm 13e40d627ca8a411fd5bf9660ce13a33 mbs1/x86_64/php-fpm-5.5.11-1.mbs1.x86_64.rpm 98178363d0318ce1c4e2ad9cde1e7761 mbs1/x86_64/php-ftp-5.5.11-1.mbs1.x86_64.rpm 85c5fc107153728574c3e1e7e7726ce8 mbs1/x86_64/php-gd-5.5.11-1.mbs1.x86_64.rpm 2fc95f9e20d873fbcc2fcee97b0c143c mbs1/x86_64/php-gettext-5.5.11-1.mbs1.x86_64.rpm 8b92121cb100980154b6a48590b0b2c2 mbs1/x86_64/php-gmp-5.5.11-1.mbs1.x86_64.rpm c340d4520fe9deca52b294dcb029d639 mbs1/x86_64/php-hash-5.5.11-1.mbs1.x86_64.rpm b2a90062d1fefcf84bea47442b918afc mbs1/x86_64/php-iconv-5.5.11-1.mbs1.x86_64.rpm 1d31d383ada26918566594bcf5c52ddd mbs1/x86_64/php-imap-5.5.11-1.mbs1.x86_64.rpm 6f26ab38a5462345486d35e27feb5461 mbs1/x86_64/php-ini-5.5.11-1.mbs1.x86_64.rpm fa6416fd0615364928175e9bd14ea79f mbs1/x86_64/php-intl-5.5.11-1.mbs1.x86_64.rpm fbbd41fb923f5cdcfd83138d84e29307 mbs1/x86_64/php-json-5.5.11-1.mbs1.x86_64.rpm 3200e7a1703d9951d77a8324ecac9789 mbs1/x86_64/php-ldap-5.5.11-1.mbs1.x86_64.rpm 7e771159e8c0037c56e847cb6364af5e mbs1/x86_64/php-mbstring-5.5.11-1.mbs1.x86_64.rpm ecfd924b6385be14f469e0bc73b63504 mbs1/x86_64/php-mcrypt-5.5.11-1.mbs1.x86_64.rpm c254ebda44d66c09ddeafc466b2b9d2d mbs1/x86_64/php-mssql-5.5.11-1.mbs1.x86_64.rpm b62000cea2d5c1a9407661e0d6a89082 mbs1/x86_64/php-mysql-5.5.11-1.mbs1.x86_64.rpm dc6fc6ac7403500826b32e39deb734de mbs1/x86_64/php-mysqli-5.5.11-1.mbs1.x86_64.rpm 222a101e0a866ecb377a8e98240c626e mbs1/x86_64/php-mysqlnd-5.5.11-1.mbs1.x86_64.rpm a6855f7058d020e0826a944a5eb4701b mbs1/x86_64/php-odbc-5.5.11-1.mbs1.x86_64.rpm 16ecefb5d132629203b3cae6e1ad0365 mbs1/x86_64/php-opcache-5.5.11-1.mbs1.x86_64.rpm 2e7843d9f5de5476d78631daf48f7b91 mbs1/x86_64/php-openssl-5.5.11-1.mbs1.x86_64.rpm 5e3bfc19b707bbcc0ec8a4b73b4bf5e0 mbs1/x86_64/php-pcntl-5.5.11-1.mbs1.x86_64.rpm 63c7e9dd81e251c0e33cd8125ceccc01 mbs1/x86_64/php-pdo-5.5.11-1.mbs1.x86_64.rpm 34eb4f845e55596dc306628b3305365a mbs1/x86_64/php-pdo_dblib-5.5.11-1.mbs1.x86_64.rpm 45a5868c8fdc4c8686dc3a37b287f680 mbs1/x86_64/php-pdo_mysql-5.5.11-1.mbs1.x86_64.rpm 3aa84d78c33d3f0ade5cc336f4ddc54f mbs1/x86_64/php-pdo_odbc-5.5.11-1.mbs1.x86_64.rpm 8105e546c9a5dcfbbc77a6539d958656 mbs1/x86_64/php-pdo_pgsql-5.5.11-1.mbs1.x86_64.rpm 0bf676b14fb71998bbd4ae736d44e427 mbs1/x86_64/php-pdo_sqlite-5.5.11-1.mbs1.x86_64.rpm ec5fffcd317ef6dad72d5a8eb228a781 mbs1/x86_64/php-pgsql-5.5.11-1.mbs1.x86_64.rpm 8418411e94dba011bc9ae65abc451c9f mbs1/x86_64/php-phar-5.5.11-1.mbs1.x86_64.rpm ea9fe59ef772a6f5ae0c4cdc3d925df3 mbs1/x86_64/php-posix-5.5.11-1.mbs1.x86_64.rpm 4e87b9158cc327ec8584c5f1f18ea5bd mbs1/x86_64/php-readline-5.5.11-1.mbs1.x86_64.rpm bf67065b17dc90aec02101e1f6a1fe12 mbs1/x86_64/php-recode-5.5.11-1.mbs1.x86_64.rpm b3d295b2cee95e6db981bf69cebdcf8d mbs1/x86_64/php-session-5.5.11-1.mbs1.x86_64.rpm e4ed6b201e8555c69ec79bb6fef7b737 mbs1/x86_64/php-shmop-5.5.11-1.mbs1.x86_64.rpm 2dc01d80b4bcc79268b817dec4f1ac7f mbs1/x86_64/php-snmp-5.5.11-1.mbs1.x86_64.rpm 0c5d69ac26d2ecd66c344c0b07931adf mbs1/x86_64/php-soap-5.5.11-1.mbs1.x86_64.rpm 9736bb0582d98950b8354e930cdc0057 mbs1/x86_64/php-sockets-5.5.11-1.mbs1.x86_64.rpm 1e654a8e206ac84e90c687070e260720 mbs1/x86_64/php-sqlite3-5.5.11-1.mbs1.x86_64.rpm 2e5d8704d2f502983fa688f5d92dd2a4 mbs1/x86_64/php-sybase_ct-5.5.11-1.mbs1.x86_64.rpm 1801cb584c4d2f141fd054fb255a4307 mbs1/x86_64/php-sysvmsg-5.5.11-1.mbs1.x86_64.rpm 01364f0dd27263317822171be37f1a7c mbs1/x86_64/php-sysvsem-5.5.11-1.mbs1.x86_64.rpm f27e00bf706fa407680c762cd8cf7788 mbs1/x86_64/php-sysvshm-5.5.11-1.mbs1.x86_64.rpm 4f3f79fa12958c1044a2514e04a23908 mbs1/x86_64/php-tidy-5.5.11-1.mbs1.x86_64.rpm d0b34a1aefd946b4b4b6a7d59ecefc8f mbs1/x86_64/php-timezonedb-2014.2-1.mbs1.x86_64.rpm db588b5b423d27875a50b6a92197d33d mbs1/x86_64/php-tokenizer-5.5.11-1.mbs1.x86_64.rpm 1a82dc5f4ddec40bbfd2b594d23e80d7 mbs1/x86_64/php-wddx-5.5.11-1.mbs1.x86_64.rpm 31eb0192e5b8c52f22e8a01622c87152 mbs1/x86_64/php-xml-5.5.11-1.mbs1.x86_64.rpm aebf69513f62f408b3bf7f4e54b28824 mbs1/x86_64/php-xmlreader-5.5.11-1.mbs1.x86_64.rpm baf3a06386cde133624e5d4352f853c2 mbs1/x86_64/php-xmlrpc-5.5.11-1.mbs1.x86_64.rpm d11f54ca7a2903792c154f093d389309 mbs1/x86_64/php-xmlwriter-5.5.11-1.mbs1.x86_64.rpm d066a70f2e583dd942cc8233f54a22b4 mbs1/x86_64/php-xsl-5.5.11-1.mbs1.x86_64.rpm 4f83d31b5c4c12224e71f18a6018c16e mbs1/x86_64/php-zip-5.5.11-1.mbs1.x86_64.rpm 96c42a96495277ae0a3b48a6f26c8f29 mbs1/x86_64/php-zlib-5.5.11-1.mbs1.x86_64.rpm 588931015052c626e59afe073a65e541 mbs1/SRPMS/php-5.5.11-1.mbs1.src.rpm 7f6426086bb10698b030fec57331e234 mbs1/SRPMS/php-apc-3.1.15-1.5.mbs1.src.rpm 966921bc3a9642e2056e79cd3db761c3 mbs1/SRPMS/php-timezonedb-2014.2-1.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFTRnFtmqjQ0CJFipgRAl55AKC/6hbtpY8KcAFw/dVpytpAX2NTZACeKyJS A5+PL+7Tbndun3dSFZDkzvk= =X5lW -----END PGP SIGNATURE----- To unsubscribe, send a email to sympa@mandrivalinux.org with this subject : unsubscribe security-announce _______________________________________________________ Want to buy your Pack or Services from Mandriva? Go to http://store.mandriva.com _______________________________________________________


(Log in to post comments)


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds