Synopsis:	Moderate: php security update

Issue date:	2010-11-29

CVE Names:	CVE-2009-5016 CVE-2010-0397 CVE-2010-1128

                   CVE-2010-1917 CVE-2010-2531 CVE-2010-3065

                   CVE-2010-3870



An input validation flaw was discovered in the PHP session serializer. 

If a PHP script generated session variable names from untrusted user 

input, a remote attacker could use this flaw to inject an arbitrary 

variable into the PHP session. (CVE-2010-3065)



An information leak flaw was discovered in the PHP var_export() function

implementation. If some fatal error occurred during the execution of 

this function (such as the exhaustion of memory or script execution time 

limit), part of the function's output was sent to the user as script 

output, possibly leading to the disclosure of sensitive information.

(CVE-2010-2531)



A numeric truncation error and an input validation flaw were found in 

the way the PHP utf8_decode() function decoded partial multi-byte 

sequences for some multi-byte encodings, sending them to output without 

them being escaped. An attacker could use these flaws to perform a 

cross-site scripting attack. (CVE-2009-5016, CVE-2010-3870)



It was discovered that the PHP lcg_value() function used insufficient

entropy to seed the pseudo-random number generator. A remote attacker 

could possibly use this flaw to predict values returned by the function, 

which are used to generate session identifiers by default. This update 

changes the function's implementation to use more entropy during 

seeding. (CVE-2010-1128)



It was discovered that the PHP fnmatch() function did not restrict the

length of the pattern argument. A remote attacker could use this flaw to

crash the PHP interpreter where a script used fnmatch() on untrusted

matching patterns. (CVE-2010-1917)



A NULL pointer dereference flaw was discovered in the PHP XML-RPC

extension. A malicious XML-RPC client or server could use this flaw to

crash the PHP interpreter via a specially-crafted XML-RPC request.

(CVE-2010-0397)



After installing the updated packages, the httpd daemon must be 

restarted for the update to take effect.



SL 4.x



      SRPMS:

php-4.3.9-3.31.src.rpm

      i386:

php-4.3.9-3.31.i386.rpm

php-devel-4.3.9-3.31.i386.rpm

php-domxml-4.3.9-3.31.i386.rpm

php-gd-4.3.9-3.31.i386.rpm

php-imap-4.3.9-3.31.i386.rpm

php-ldap-4.3.9-3.31.i386.rpm

php-mbstring-4.3.9-3.31.i386.rpm

php-mysql-4.3.9-3.31.i386.rpm

php-ncurses-4.3.9-3.31.i386.rpm

php-odbc-4.3.9-3.31.i386.rpm

php-pear-4.3.9-3.31.i386.rpm

php-pgsql-4.3.9-3.31.i386.rpm

php-snmp-4.3.9-3.31.i386.rpm

php-xmlrpc-4.3.9-3.31.i386.rpm

      x86_64:

php-4.3.9-3.31.x86_64.rpm

php-devel-4.3.9-3.31.x86_64.rpm

php-domxml-4.3.9-3.31.x86_64.rpm

php-gd-4.3.9-3.31.x86_64.rpm

php-imap-4.3.9-3.31.x86_64.rpm

php-ldap-4.3.9-3.31.x86_64.rpm

php-mbstring-4.3.9-3.31.x86_64.rpm

php-mysql-4.3.9-3.31.x86_64.rpm

php-ncurses-4.3.9-3.31.x86_64.rpm

php-odbc-4.3.9-3.31.x86_64.rpm

php-pear-4.3.9-3.31.x86_64.rpm

php-pgsql-4.3.9-3.31.x86_64.rpm

php-snmp-4.3.9-3.31.x86_64.rpm

php-xmlrpc-4.3.9-3.31.x86_64.rpm



SL 5.x



      SRPMS:

php-5.1.6-27.el5_5.3.src.rpm

      i386:

php-5.1.6-27.el5_5.3.i386.rpm

php-bcmath-5.1.6-27.el5_5.3.i386.rpm

php-cli-5.1.6-27.el5_5.3.i386.rpm

php-common-5.1.6-27.el5_5.3.i386.rpm

php-dba-5.1.6-27.el5_5.3.i386.rpm

php-devel-5.1.6-27.el5_5.3.i386.rpm

php-gd-5.1.6-27.el5_5.3.i386.rpm

php-imap-5.1.6-27.el5_5.3.i386.rpm

php-ldap-5.1.6-27.el5_5.3.i386.rpm

php-mbstring-5.1.6-27.el5_5.3.i386.rpm

php-mysql-5.1.6-27.el5_5.3.i386.rpm

php-ncurses-5.1.6-27.el5_5.3.i386.rpm

php-odbc-5.1.6-27.el5_5.3.i386.rpm

php-pdo-5.1.6-27.el5_5.3.i386.rpm

php-pgsql-5.1.6-27.el5_5.3.i386.rpm

php-snmp-5.1.6-27.el5_5.3.i386.rpm

php-soap-5.1.6-27.el5_5.3.i386.rpm

php-xml-5.1.6-27.el5_5.3.i386.rpm

php-xmlrpc-5.1.6-27.el5_5.3.i386.rpm



      x86_64:

php-5.1.6-27.el5_5.3.x86_64.rpm

php-bcmath-5.1.6-27.el5_5.3.x86_64.rpm

php-cli-5.1.6-27.el5_5.3.x86_64.rpm

php-common-5.1.6-27.el5_5.3.x86_64.rpm

php-dba-5.1.6-27.el5_5.3.x86_64.rpm

php-devel-5.1.6-27.el5_5.3.x86_64.rpm

php-gd-5.1.6-27.el5_5.3.x86_64.rpm

php-imap-5.1.6-27.el5_5.3.x86_64.rpm

php-ldap-5.1.6-27.el5_5.3.x86_64.rpm

php-mbstring-5.1.6-27.el5_5.3.x86_64.rpm

php-mysql-5.1.6-27.el5_5.3.x86_64.rpm

php-ncurses-5.1.6-27.el5_5.3.x86_64.rpm

php-odbc-5.1.6-27.el5_5.3.x86_64.rpm

php-pdo-5.1.6-27.el5_5.3.x86_64.rpm

php-pgsql-5.1.6-27.el5_5.3.x86_64.rpm

php-snmp-5.1.6-27.el5_5.3.x86_64.rpm

php-soap-5.1.6-27.el5_5.3.x86_64.rpm

php-xml-5.1.6-27.el5_5.3.x86_64.rpm

php-xmlrpc-5.1.6-27.el5_5.3.x86_64.rpm



-Connie Sieh

-Troy Dawson