This is a maintenance and security update that upgrades php to 5.3.4 for 2010.0/2010.1.

Security Enhancements and Fixes in PHP 5.3.4 :

  - Paths with NULL in them (foo\0bar.txt) are now     considered as invalid (CVE-2006-7243).

  - Fixed bug #53512 (NumberFormatter::setSymbol crash on     bogus values) (CVE-2010-4409)

Please note that CVE-2010-4150, CVE-2010-3870, CVE-2010-3436, CVE-2010-3709, CVE-2010-3710 were fixed in previous advisories.

Key Bug Fixes in PHP 5.3.4 include :

  - Added stat support for zip stream.

    - Added follow_location (enabled by default) option for       the http stream support.

  - Added a 3rd parameter to get_html_translation_table. It     now takes a charset hint, like htmlentities et al.

  - Implemented FR #52348, added new constant ZEND_MULTIBYTE     to detect zend multibyte at runtime.

  - Multiple improvements to the FPM SAPI.

    - Over 100 other bug fixes.

Additional post 5.3.4 fixes :

  - Fixed bug #53517 (segfault in pgsql_stmt_execute() when     postgres is down).

  - Fixed bug #53541 (format string bug in ext/phar).

Additionally some of the PECL extensions has been upgraded and/or rebuilt for the new php version.

Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057)

Note: This update disables file writing by default. A new PHP configuration directive, 'xsl.security_prefs', can be used to enable file writing in XSLT.

A flaw was found in the way PHP validated file names in file upload requests. A remote attacker could possibly use this flaw to bypass the sanitization of the uploaded file names, and cause a PHP script to store the uploaded file in an unexpected directory, by using a directory traversal attack. (CVE-2012-1172)

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the PHP phar extension processed certain fields of tar archive files. A remote attacker could provide a specially crafted tar archive file that, when processed by a PHP application using the phar extension, could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running PHP. (CVE-2012-2386)

A format string flaw was found in the way the PHP phar extension processed certain PHAR files. A remote attacker could provide a specially crafted PHAR file, which once processed in a PHP application using the phar extension, could lead to information disclosure and possibly arbitrary code execution via a crafted phar:// URI.
(CVE-2010-2950)

A flaw was found in the DES algorithm implementation in the crypt() password hashing function in PHP. If the password string to be hashed contained certain characters, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. (CVE-2012-2143)

Note: With this update, passwords are no longer truncated when performing DES hashing. Therefore, new hashes of the affected passwords will not match stored hashes generated using vulnerable PHP versions, and will need to be updated.

It was discovered that the fix for CVE-2012-1823, released via RHSA-2012:0546, did not properly filter all php-cgi command line arguments. A specially crafted request to a PHP script could cause the PHP interpreter to execute the script in a loop, or output usage information that triggers an Internal Server Error. (CVE-2012-2336)

A memory leak flaw was found in the PHP strtotime() function call. A remote attacker could possibly use this flaw to cause excessive memory consumption by triggering many strtotime() function calls.
(CVE-2012-0789)

A NULL pointer dereference flaw was found in the PHP tidy_diagnose() function. A remote attacker could use specially crafted input to crash an application that uses tidy::diagnose. (CVE-2012-0781)

It was found that PHP did not check the zend_strndup() function's return value in certain cases. A remote attacker could possibly use this flaw to crash a PHP application. (CVE-2011-4153)

Upstream acknowledges Rubin Xu and Joseph Bonneau as the original reporters of CVE-2012-2143.

All php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057)

Note: This update disables file writing by default. A new PHP configuration directive, 'xsl.security_prefs', can be used to enable file writing in XSLT.

A flaw was found in the way PHP validated file names in file upload requests. A remote attacker could possibly use this flaw to bypass the sanitization of the uploaded file names, and cause a PHP script to store the uploaded file in an unexpected directory, by using a directory traversal attack. (CVE-2012-1172)

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the PHP phar extension processed certain fields of tar archive files. A remote attacker could provide a specially crafted tar archive file that, when processed by a PHP application using the phar extension, could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running PHP. (CVE-2012-2386)

A format string flaw was found in the way the PHP phar extension processed certain PHAR files. A remote attacker could provide a specially crafted PHAR file, which once processed in a PHP application using the phar extension, could lead to information disclosure and possibly arbitrary code execution via a crafted phar:// URI.
(CVE-2010-2950)

A flaw was found in the DES algorithm implementation in the crypt() password hashing function in PHP. If the password string to be hashed contained certain characters, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. (CVE-2012-2143)

Note: With this update, passwords are no longer truncated when performing DES hashing. Therefore, new hashes of the affected passwords will not match stored hashes generated using vulnerable PHP versions, and will need to be updated.

It was discovered that the fix for CVE-2012-1823, released via a previous update, did not properly filter all php-cgi command line arguments. A specially crafted request to a PHP script could cause the PHP interpreter to execute the script in a loop, or output usage information that triggers an Internal Server Error. (CVE-2012-2336)

A memory leak flaw was found in the PHP strtotime() function call. A remote attacker could possibly use this flaw to cause excessive memory consumption by triggering many strtotime() function calls.
(CVE-2012-0789)

It was found that PHP did not check the zend_strndup() function's return value in certain cases. A remote attacker could possibly use this flaw to crash a PHP application. (CVE-2011-4153)

All php53 users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

PHP was updated to version 5.3.3 to fix serveral security issues.

(CVE-2010-0397, CVE-2010-1860, CVE-2010-1862, CVE-2010-1864, CVE-2010-1866, CVE-2010-1914, CVE-2010-1915, CVE-2010-1917, CVE-2010-2093, CVE-2010-2094, CVE-2010-2097, CVE-2010-2100, CVE-2010-2101, CVE-2010-2190, CVE-2010-2191, CVE-2010-2225, CVE-2010-2531, CVE-2010-2950, CVE-2010-3062, CVE-2010-3063, CVE-2010-3064, CVE-2010-3065)

Auke van Slooten discovered that PHP incorrectly handled certain xmlrpc requests. An attacker could exploit this issue to cause the PHP server to crash, resulting in a denial of service. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.04 and 9.10. (CVE-2010-0397)

It was discovered that the pseudorandom number generator in PHP did not provide the expected entropy. An attacker could exploit this issue to predict values that were intended to be random, such as session cookies. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.04 and 9.10. (CVE-2010-1128)

It was discovered that PHP did not properly handle directory pathnames that lacked a trailing slash character. An attacker could exploit this issue to bypass safe_mode restrictions. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS, 9.04 and 9.10. (CVE-2010-1129)

Grzegorz Stachowiak discovered that the PHP session extension did not properly handle semicolon characters. An attacker could exploit this issue to bypass safe_mode restrictions. This issue only affected Ubuntu 8.04 LTS, 9.04 and 9.10. (CVE-2010-1130)

Stefan Esser discovered that PHP incorrectly decoded remote HTTP chunked encoding streams. An attacker could exploit this issue to cause the PHP server to crash and possibly execute arbitrary code with application privileges. This issue only affected Ubuntu 10.04 LTS.
(CVE-2010-1866)

Mateusz Kocielski discovered that certain PHP SQLite functions incorrectly handled empty SQL queries. An attacker could exploit this issue to possibly execute arbitrary code with application privileges.
(CVE-2010-1868)

Mateusz Kocielski discovered that PHP incorrectly handled certain arguments to the fnmatch function. An attacker could exploit this flaw and cause the PHP server to consume all available stack memory, resulting in a denial of service. (CVE-2010-1917)

Stefan Esser discovered that PHP incorrectly handled certain strings in the phar extension. An attacker could exploit this flaw to possibly view sensitive information. This issue only affected Ubuntu 10.04 LTS.
(CVE-2010-2094, CVE-2010-2950)

Stefan Esser discovered that PHP incorrectly handled deserialization of SPLObjectStorage objects. A remote attacker could exploit this issue to view sensitive information and possibly execute arbitrary code with application privileges. This issue only affected Ubuntu 8.04 LTS, 9.04, 9.10 and 10.04 LTS. (CVE-2010-2225)

It was discovered that PHP incorrectly filtered error messages when limits for memory, execution time, or recursion were exceeded. A remote attacker could exploit this issue to possibly view sensitive information. (CVE-2010-2531)

Stefan Esser discovered that the PHP session serializer incorrectly handled the PS_UNDEF_MARKER marker. An attacker could exploit this issue to alter arbitrary session variables. (CVE-2010-3065).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the web server's banner, the version of HP System Management Homepage (SMH) hosted on the remote host is earlier than 6.3.  Such versions are reportedly affected by the following vulnerabilities :

  - An error exists in the function 'fnmatch' in the     bundled version of PHP that can lead to stack     exhaustion. (CVE-2010-1917)

  - An information disclosure vulnerability exists in the     'var_export' function in the bundled version of PHP     that can be triggered when handling certain error     conditions. (CVE-2010-2531)

  - A double free vulnerability in the     'ssl3_get_key_exchange()' function in the third-party     OpenSSL library could be abused to crash the     application. (CVE-2010-2939)

  - A format string vulnerability in the phar extension     in the bundled version of PHP could lead to the     disclosure of memory contents and possibly allow     execution of arbitrary code via a specially crafted     'phar://' URI. (CVE-2010-2950)

  - A NULL pointer dereference in     'ZipArchive::getArchiveComment' included with the     bundled version of PHP can be abused to crash the     application. (CVE-2010-3709)

  - The bundled version of libxml2 may read from invalid     memory locations when processing malformed XPath     expressions, resulting in an application crash.
    (CVE-2010-4008)

  - An error in the 'mb_strcut()' function in the bundled     version of PHP can be exploited by passing a large     'length' parameter to disclose potentially sensitive     information from the heap. (CVE-2010-4156)

  - An as-yet unspecified remote code execution     vulnerability could allow an authenticated user to     execute arbitrary code with system privileges.
    (CVE-2011-1540)

  - An as-yet unspecified, unauthorized access vulnerability     could lead to a complete system compromise.
    (CVE-2011-1541)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1046 advisory.

  - php: Format string flaw in phar extension via phar_stream_flush() (MOPS-2010-024) (CVE-2010-2950)

  - php: zend_strndup() NULL pointer dereference may cause DoS (CVE-2011-4153)

  - php: XSLT file writing vulnerability (CVE-2012-0057)

  - php: tidy_diagnose() NULL pointer dereference may cause DoS (CVE-2012-0781)

  - php: strtotime timezone memory leak (CVE-2012-0789)

  - php: $_FILES array indexes corruption (CVE-2012-1172)

  - BSD crypt(): DES encrypted password weakness (CVE-2012-2143)

  - php: incomplete CVE-2012-1823 fix - missing filtering of -T and -h (CVE-2012-2336)

  - php: Integer overflow leading to heap-buffer overflow in the Phar extension (CVE-2012-2386)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1047 advisory.

    - add security fix for CVE-2010-2950
    - fix tests for CVE-2012-2143, CVE-2012-0789
    - add security fix for CVE-2012-2336

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.7.

Mac OS X 10.6.7 contains security fixes for the following products :

  - AirPort
  - Apache
  - AppleScript
  - ATS
  - bzip2
  - CarbonCore
  - ClamAV
  - CoreText
  - File Quarantine
  - HFS
  - ImageIO
  - Image RAW
  - Installer
  - Kerberos
  - Kernel
  - Libinfo
  - libxml
  - Mailman
  - PHP
  - QuickLook
  - QuickTime
  - Ruby
  - Samba
  - Subversion
  - Terminal
  - X11

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-762:04 advisory.

    PHP is an HTML-embedded scripting language that allows developers to write dynamically generated web     pages. PHP is ideal for writing database-enabled websites, with built-in integration for several     commercial and non-commercial database management systems. PHP is often used as a replacement for CGI     scripts.
    The php package contains a module that adds support for the PHP language to the Apache HTTP Server.
    Security issues fixed with this release:
     CVE-2010-2950     Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-     dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code     via a crafted phar:// URI that is not properly handled by the phar_stream_flush function, leading to     errors in the php_stream_wrapper_log_error function. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2010-2094.
     CVE-2011-4153     PHP 5.3.8 does not always check the return value of the zend_strndup function, which might allow remote     attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input     to an application that performs strndup operations on untrusted string data, as demonstrated by the define     function in zend_builtin_functions.c, and unspecified functions in ext/soap/php_sdl.c,     ext/standard/syslog.c, ext/standard/browscap.c, ext/oci8/oci8.c, ext/com_dotnet/com_typeinfo.c, and     main/php_open_temporary_file.c.
     CVE-2012-0057     PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary     files via a crafted XSLT stylesheet that uses the libxslt output extension.
     CVE-2012-0781     The tidy_diagnose function in PHP 5.3.8 might allow remote attackers to cause a denial of service (NULL     pointer dereference and application crash) via crafted input to an application that attempts to perform     Tidy::diagnose operations on invalid objects, a different vulnerability than CVE-2011-4153.
     CVE-2012-0789     Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of     service (memory consumption) by triggering many strtotime function calls, which are not properly handled     by the php_date_parse_tzfile cache.
     CVE-2012-1172     The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open     square bracket) characters in name values, which makes it easier for remote attackers to cause a denial of     service (malformed $_FILES indexes) or conduct directory traversal attacks during multi-file uploads by     leveraging a script that lacks its own filename restrictions.
     CVE-2012-2336     sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-     cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote     attackers to cause a denial of service (resource consumption) by placing command-line options in the query     string, related to lack of skipping a certain php_getopt for the 'T' case. NOTE: this vulnerability exists     because of an incomplete fix for CVE-2012-1823.
     CVE-2012-2143     The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL,     and other products, does not process the complete cleartext password if this password contains a 0x80     character, which makes it easier for context-dependent attackers to obtain access via an authentication     attempt with an initial substring of the intended password, as demonstrated by a Unicode password.
     CVE-2012-2386     Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14     and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or     possibly execute arbitrary code via a crafted tar file that triggers a heap-based buffer overflow.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated php53 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057)

Note: This update disables file writing by default. A new PHP configuration directive, 'xsl.security_prefs', can be used to enable file writing in XSLT.

A flaw was found in the way PHP validated file names in file upload requests. A remote attacker could possibly use this flaw to bypass the sanitization of the uploaded file names, and cause a PHP script to store the uploaded file in an unexpected directory, by using a directory traversal attack. (CVE-2012-1172)

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the PHP phar extension processed certain fields of tar archive files. A remote attacker could provide a specially crafted tar archive file that, when processed by a PHP application using the phar extension, could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running PHP. (CVE-2012-2386)

A format string flaw was found in the way the PHP phar extension processed certain PHAR files. A remote attacker could provide a specially crafted PHAR file, which once processed in a PHP application using the phar extension, could lead to information disclosure and possibly arbitrary code execution via a crafted phar:// URI.
(CVE-2010-2950)

A flaw was found in the DES algorithm implementation in the crypt() password hashing function in PHP. If the password string to be hashed contained certain characters, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. (CVE-2012-2143)

Note: With this update, passwords are no longer truncated when performing DES hashing. Therefore, new hashes of the affected passwords will not match stored hashes generated using vulnerable PHP versions, and will need to be updated.

It was discovered that the fix for CVE-2012-1823, released via RHSA-2012:0547, did not properly filter all php-cgi command line arguments. A specially crafted request to a PHP script could cause the PHP interpreter to execute the script in a loop, or output usage information that triggers an Internal Server Error. (CVE-2012-2336)

A memory leak flaw was found in the PHP strtotime() function call. A remote attacker could possibly use this flaw to cause excessive memory consumption by triggering many strtotime() function calls.
(CVE-2012-0789)

It was found that PHP did not check the zend_strndup() function's return value in certain cases. A remote attacker could possibly use this flaw to crash a PHP application. (CVE-2011-4153)

Upstream acknowledges Rubin Xu and Joseph Bonneau as the original reporters of CVE-2012-2143.

All php53 users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

The remote host is affected by the vulnerability described in GLSA-201110-06 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could execute arbitrary code, obtain       sensitive information from process memory, bypass intended access       restrictions, or cause a Denial of Service in various ways.
    A remote attacker could cause a Denial of Service in various ways,       bypass spam detections, or bypass open_basedir restrictions.
  Workaround :

    There is no known workaround at this time.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
51196	Mandriva Linux Security Advisory : php (MDVSA-2010:254)	Nessus	Mandriva Local Security Checks	2010/12/16	2021/1/6	medium
59938	CentOS 6 : php (CESA-2012:1046)	Nessus	CentOS Local Security Checks	2012/7/11	2021/1/4	high
61356	Scientific Linux Security Update : php53 on SL5.x i386/x86_64 (20120627)	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
75429	openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2010:0599-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	high
49306	Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : php5 vulnerabilities (USN-989-1)	Nessus	Ubuntu Local Security Checks	2010/9/21	2019/9/19	high
53532	HP System Management Homepage < 6.3 Multiple Vulnerabilities	Nessus	Web Servers	2011/4/22	2022/4/11	critical
59752	RHEL 6 : php (RHSA-2012:1046)	Nessus	Red Hat Local Security Checks	2012/6/28	2024/4/21	critical
68571	Oracle Linux 5 : php53 (ELSA-2012-1047)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	critical
49210	openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2010:0599-1)	Nessus	SuSE Local Security Checks	2010/9/13	2021/1/14	high
52754	Mac OS X 10.6.x < 10.6.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2011/3/22	2024/5/28	high
283996	MiracleLinux 4 : php-5.3.3-14.AXS4 (AXSA:2012-762:04)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/2/12	critical
67089	CentOS 5 : php53 (CESA-2012:1047)	Nessus	CentOS Local Security Checks	2013/6/29	2021/1/4	high
59753	RHEL 5 : php53 (RHSA-2012:1047)	Nessus	Red Hat Local Security Checks	2012/6/28	2021/1/14	high
56459	GLSA-201110-06 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2011/10/12	2021/1/6	critical

检测

插件搜索

medium

high

high

high

high

critical

critical

critical

high

high

critical

high

high

critical