|
SecurityLex.Org
|
|
|
Your search for "24887" returned:
| Nessus Plugin ID: 24887 | Name: [GLSA-200703-21] PHP: Multiple vulnerabilities |
| CVE References: CVE-2006-5465 (cve.mitre.org, nvd.nist.gov) CVE-2007-0906 (cve.mitre.org, nvd.nist.gov) CVE-2007-0907 (cve.mitre.org, nvd.nist.gov) CVE-2007-0908 (cve.mitre.org, nvd.nist.gov) CVE-2007-0909 (cve.mitre.org, nvd.nist.gov) CVE-2007-0910 (cve.mitre.org, nvd.nist.gov) CVE-2007-0911 (cve.mitre.org, nvd.nist.gov) CVE-2007-0988 (cve.mitre.org, nvd.nist.gov) CVE-2007-1286 (cve.mitre.org, nvd.nist.gov) CVE-2007-1375 (cve.mitre.org, nvd.nist.gov) CVE-2007-1376 (cve.mitre.org, nvd.nist.gov) CVE-2007-1380 (cve.mitre.org, nvd.nist.gov) CVE-2007-1383 (cve.mitre.org, nvd.nist.gov) |
| SANS/FBI TOP20 Reference: |
| Group/Family: Gentoo Local Security Checks |
| Risk: Critical |
Description: Synopsis :
The remote host is missing the GLSA-200703-21 security update.
Description :
The remote host is affected by the vulnerability described in GLSA-200703-21
(PHP: Multiple vulnerabilities)
Several vulnerabilities were found in PHP by the Hardened-PHP Project
and other researchers. These vulnerabilities include a heap-based
buffer overflow in htmlentities() and htmlspecialchars() if called with
UTF-8 parameters, and an off-by-one error in str_ireplace(). Other
vulnerabilities were also found in the PHP4 branch, including possible
overflows, stack corruptions and a format string vulnerability in the
*print() functions on 64 bit systems.
Impact
Remote attackers might be able to exploit these issues in PHP
applications making use of the affected functions, potentially
resulting in the execution of arbitrary code, Denial of Service,
execution of scripted contents in the context of the affected site,
security bypass or information leak.
Workaround
There is no known workaround at this time.
See also :
http://www.php.net/releases/4_4_5.php
http://www.php.net/releases/5_2_1.php
http://www.gentoo.org/security/en/glsa/glsa-200703-21.xml
Solution :
All PHP users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose "dev-lang/php"
/ CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
|
| Created: 2007-04-03 16:25:02 | Last Changed: 2010-03-01 10:09:48 |
|
|