ius-coredev team mailing list archive

[Launchpad Bug Tracker <925772@xxxxxxxxxxxxxxxxxx>]

This bug was fixed in the package php5 - 5.3.6-13ubuntu3.5

---------------
php5 (5.3.6-13ubuntu3.5) oneiric-security; urgency=low

  * SECURITY UPDATE: memory allocation failure denial of service
    - debian/patches/php5-CVE-2011-4153.patch: check result of
      zend_strdup() and calloc() for failed allocations
    - CVE-2011-4153
  * SECURITY UPDATE: predictable hash collision denial of service
    (LP: #910296)
    - debian/patches/php5-CVE-2011-4885.patch: add max_input_vars
      directive with default limit of 1000
    - ATTENTION: this update changes previous php5 behavior by
      limiting the number of external input variables to 1000.
      This may be increased by adding a "max_input_vars"
      directive to the php.ini configuration file. See
      http://www.php.net/manual/en/info.configuration.php#ini.max-input-vars
      for more information.
    - CVE-2011-4885
  * SECURITY UPDATE: remote code execution vulnerability introduced by
    the fix for CVE-2011-4885 (LP: #925772)
    - debian/patches/php5-CVE-2012-0830.patch: return rather than
      continuing if max_input_vars limit is reached
    - CVE-2012-0830
  * SECURITY UPDATE: XSLT arbitrary file overwrite attack
    - debian/patches/php5-CVE-2012-0057.patch: add xsl.security_prefs
      ini option to define forbidden operations within XSLT stylesheets
    - CVE-2012-0057
  * SECURITY UPDATE: PDORow session denial of service
    - debian/patches/php5-CVE-2012-0788.patch: fail gracefully when
      attempting to serialize PDORow instances
    - CVE-2012-0788
  * SECURITY UPDATE: magic_quotes_gpc remote disable vulnerability
    - debian/patches/php5-CVE-2012-0831.patch: always restore
      magic_quote_gpc on request shutdown
    - CVE-2012-0831
 -- Steve Beattie <sbeattie@xxxxxxxxxx>   Wed, 08 Feb 2012 20:56:28 -0800

** Changed in: php5 (Ubuntu)
       Status: New => Fix Released

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2011-4153

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2011-4885

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2012-0057

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2012-0788

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2012-0831

-- 
You received this bug notification because you are a member of IUS Core
Development, which is subscribed to IUS Community Project.
https://bugs.launchpad.net/bugs/925772

Title:
  UPDATE REQUEST: php53u 5.3.10 is available upstream

Status in IUS Community Project:
  Fix Released
Status in “php5” package in Ubuntu:
  Fix Released

Bug description:
  New Source from Upstream: http://www.php.net/downloads.php

To manage notifications about this bug go to:
https://bugs.launchpad.net/ius/+bug/925772/+subscriptions