Synopsis:	Moderate: php security update
Issue date:	2010-11-29
CVE Names:	CVE-2009-5016 CVE-2010-0397 CVE-2010-1128
                   CVE-2010-1917 CVE-2010-2531 CVE-2010-3065
                   CVE-2010-3870

An input validation flaw was discovered in the PHP session serializer. 
If a PHP script generated session variable names from untrusted user 
input, a remote attacker could use this flaw to inject an arbitrary 
variable into the PHP session. (CVE-2010-3065)

An information leak flaw was discovered in the PHP var_export() function
implementation. If some fatal error occurred during the execution of 
this function (such as the exhaustion of memory or script execution time 
limit), part of the function's output was sent to the user as script 
output, possibly leading to the disclosure of sensitive information.
(CVE-2010-2531)

A numeric truncation error and an input validation flaw were found in 
the way the PHP utf8_decode() function decoded partial multi-byte 
sequences for some multi-byte encodings, sending them to output without 
them being escaped. An attacker could use these flaws to perform a 
cross-site scripting attack. (CVE-2009-5016, CVE-2010-3870)

It was discovered that the PHP lcg_value() function used insufficient
entropy to seed the pseudo-random number generator. A remote attacker 
could possibly use this flaw to predict values returned by the function, 
which are used to generate session identifiers by default. This update 
changes the function's implementation to use more entropy during 
seeding. (CVE-2010-1128)

It was discovered that the PHP fnmatch() function did not restrict the
length of the pattern argument. A remote attacker could use this flaw to
crash the PHP interpreter where a script used fnmatch() on untrusted
matching patterns. (CVE-2010-1917)

A NULL pointer dereference flaw was discovered in the PHP XML-RPC
extension. A malicious XML-RPC client or server could use this flaw to
crash the PHP interpreter via a specially-crafted XML-RPC request.
(CVE-2010-0397)

After installing the updated packages, the httpd daemon must be 
restarted for the update to take effect.

SL 4.x

      SRPMS:
php-4.3.9-3.31.src.rpm
      i386:
php-4.3.9-3.31.i386.rpm
php-devel-4.3.9-3.31.i386.rpm
php-domxml-4.3.9-3.31.i386.rpm
php-gd-4.3.9-3.31.i386.rpm
php-imap-4.3.9-3.31.i386.rpm
php-ldap-4.3.9-3.31.i386.rpm
php-mbstring-4.3.9-3.31.i386.rpm
php-mysql-4.3.9-3.31.i386.rpm
php-ncurses-4.3.9-3.31.i386.rpm
php-odbc-4.3.9-3.31.i386.rpm
php-pear-4.3.9-3.31.i386.rpm
php-pgsql-4.3.9-3.31.i386.rpm
php-snmp-4.3.9-3.31.i386.rpm
php-xmlrpc-4.3.9-3.31.i386.rpm
      x86_64:
php-4.3.9-3.31.x86_64.rpm
php-devel-4.3.9-3.31.x86_64.rpm
php-domxml-4.3.9-3.31.x86_64.rpm
php-gd-4.3.9-3.31.x86_64.rpm
php-imap-4.3.9-3.31.x86_64.rpm
php-ldap-4.3.9-3.31.x86_64.rpm
php-mbstring-4.3.9-3.31.x86_64.rpm
php-mysql-4.3.9-3.31.x86_64.rpm
php-ncurses-4.3.9-3.31.x86_64.rpm
php-odbc-4.3.9-3.31.x86_64.rpm
php-pear-4.3.9-3.31.x86_64.rpm
php-pgsql-4.3.9-3.31.x86_64.rpm
php-snmp-4.3.9-3.31.x86_64.rpm
php-xmlrpc-4.3.9-3.31.x86_64.rpm

SL 5.x

      SRPMS:
php-5.1.6-27.el5_5.3.src.rpm
      i386:
php-5.1.6-27.el5_5.3.i386.rpm
php-bcmath-5.1.6-27.el5_5.3.i386.rpm
php-cli-5.1.6-27.el5_5.3.i386.rpm
php-common-5.1.6-27.el5_5.3.i386.rpm
php-dba-5.1.6-27.el5_5.3.i386.rpm
php-devel-5.1.6-27.el5_5.3.i386.rpm
php-gd-5.1.6-27.el5_5.3.i386.rpm
php-imap-5.1.6-27.el5_5.3.i386.rpm
php-ldap-5.1.6-27.el5_5.3.i386.rpm
php-mbstring-5.1.6-27.el5_5.3.i386.rpm
php-mysql-5.1.6-27.el5_5.3.i386.rpm
php-ncurses-5.1.6-27.el5_5.3.i386.rpm
php-odbc-5.1.6-27.el5_5.3.i386.rpm
php-pdo-5.1.6-27.el5_5.3.i386.rpm
php-pgsql-5.1.6-27.el5_5.3.i386.rpm
php-snmp-5.1.6-27.el5_5.3.i386.rpm
php-soap-5.1.6-27.el5_5.3.i386.rpm
php-xml-5.1.6-27.el5_5.3.i386.rpm
php-xmlrpc-5.1.6-27.el5_5.3.i386.rpm

      x86_64:
php-5.1.6-27.el5_5.3.x86_64.rpm
php-bcmath-5.1.6-27.el5_5.3.x86_64.rpm
php-cli-5.1.6-27.el5_5.3.x86_64.rpm
php-common-5.1.6-27.el5_5.3.x86_64.rpm
php-dba-5.1.6-27.el5_5.3.x86_64.rpm
php-devel-5.1.6-27.el5_5.3.x86_64.rpm
php-gd-5.1.6-27.el5_5.3.x86_64.rpm
php-imap-5.1.6-27.el5_5.3.x86_64.rpm
php-ldap-5.1.6-27.el5_5.3.x86_64.rpm
php-mbstring-5.1.6-27.el5_5.3.x86_64.rpm
php-mysql-5.1.6-27.el5_5.3.x86_64.rpm
php-ncurses-5.1.6-27.el5_5.3.x86_64.rpm
php-odbc-5.1.6-27.el5_5.3.x86_64.rpm
php-pdo-5.1.6-27.el5_5.3.x86_64.rpm
php-pgsql-5.1.6-27.el5_5.3.x86_64.rpm
php-snmp-5.1.6-27.el5_5.3.x86_64.rpm
php-soap-5.1.6-27.el5_5.3.x86_64.rpm
php-xml-5.1.6-27.el5_5.3.x86_64.rpm
php-xmlrpc-5.1.6-27.el5_5.3.x86_64.rpm

-Connie Sieh
-Troy Dawson