From 74130777c48a3f53bdd50ccd9b667c33d6b0ede8 Mon Sep 17 00:00:00 2001 From: Neil McGovern Date: Sun, 11 Sep 2005 20:27:29 +0000 Subject: php4 DTSA (unpublished) git-svn-id: svn+ssh://svn.debian.org/svn/secure-testing@1916 e39458fd-73e7-0310-bf30-c45bca0a0e42 --- website/DTSA/DTSA-16-1.html | 111 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 111 insertions(+) create mode 100644 website/DTSA/DTSA-16-1.html (limited to 'website/DTSA') diff --git a/website/DTSA/DTSA-16-1.html b/website/DTSA/DTSA-16-1.html new file mode 100644 index 0000000000..7adf507256 --- /dev/null +++ b/website/DTSA/DTSA-16-1.html @@ -0,0 +1,111 @@ + + + Debian testing security team - Advisory + + + + +
+ + + + + Debian Project +
+
+ + + + + + + + + + + +
+ Debian testing security team - Advisory +
+ + +
+ + +

DTSA-16-1

+
+
Date Reported:
+
September 10th, 2005
+
Affected Package:
+
php4
+
Vulnerability:
+
several vulnerabilities
+
Problem-Scope:
+
remote/local
+
Debian-specific:
+
No
+
CVE:
+
+CAN-2005-1751 +CAN-2005-1921 +CAN-2005-2498 +
+
More information:
+
Several security related problems have been found in PHP4, the 
+server-side, HTML-embedded scripting language. The Common 
+Vulnerabilities and Exposures project identifies the following 
+problems: 
+ 
+CAN-2005-1751 
+ 
+Eric Romang discovered insecure temporary files in the shtool 
+utility shipped with PHP that can exploited by a local attacker to 
+overwrite arbitrary files. Only this vulnerability affects 
+packages in oldstable. 
+ 
+CAN-2005-1921 
+ 
+GulfTech has discovered that PEAR XML_RPC is vulnerable to a 
+remote PHP code execution vulnerability that may allow an attacker 
+to compromise a vulnerable server. 
+ 
+CAN-2005-2498 
+ 
+Stefan Esser discovered another vulnerability in the XML-RPC 
+libraries that allows injection of arbitrary PHP code into eval() 
+statements. 
+
+
For the testing distribution (etch) this is fixed in version 4.3.10-16etch1
+
For the unstable distribution (sid) this is fixed in version 4.4.0-2
+
This upgrade is recommended if you use php4.
+
If you have the secure testing lines in your sources.list, you can update by running this command as root:
+ +
apt-get update && apt-get upgrade
+
+ +
+
To use the Debian testing security archive, add the following lines to your /etc/apt/sources.list:
+
+
deb http://secure-testing-mirrors.debian.net/debian-secure-testing etch-proposed-updates/security-updates main contrib non-free
+
deb-src http://secure-testing-mirrors.debian.net/debian-secure-testing etch-proposed-updates/security-updates main contrib non-free
+
+
The archive signing key can be downloaded from
+
http://secure-testing.debian.net/ziyi-2005-7.asc
+ +
+ + +
+ + Valid HTML 4.01! + + Valid CSS! + + + + -- cgit v1.2.3