USN-720-1: PHP vulnerabilities

Releases

• Ubuntu 8.10
• Ubuntu 8.04
• Ubuntu 7.10
• Ubuntu 6.06

Packages

• php5 -

Details

It was discovered that PHP did not properly enforce php_admin_value and
php_admin_flag restrictions in the Apache configuration file. A local attacker
could create a specially crafted PHP script that would bypass intended security
restrictions. This issue only applied to Ubuntu 6.06 LTS, 7.10, and 8.04 LTS.
(CVE-2007-5900)

It was discovered that PHP did not correctly handle certain malformed font
files. If a PHP application were tricked into processing a specially crafted
font file, an attacker may be able to cause a denial of service and possibly
execute arbitrary code with application privileges. (CVE-2008-3658)

It was discovered that PHP did not properly check the delimiter argument to the
explode function. If a script passed untrusted input to the explode function, an
attacker could cause a denial of service and possibly execute arbitrary code
with application privileges. (CVE-2008-3659)

It was discovered that PHP, when used as FastCGI module, did not properly
sanitize requests. By performing a request with multiple dots preceding the
extension, an attacker could cause a denial of service. (CVE-2008-3660)

It was discovered that PHP did not properly handle Unicode conversion in the
mbstring extension. If a PHP application were tricked into processing a
specially crafted string containing an HTML entity, an attacker could execute
arbitrary code with application privileges. (CVE-2008-5557)

It was discovered that PHP did not properly initialize the page_uid and page_gid
global variables for use by the SAPI php_getuid function. An attacker could
exploit this issue to bypass safe_mode restrictions. (CVE-2008-5624)

It was dicovered that PHP did not properly enforce error_log safe_mode
restrictions when set by php_admin_flag in the Apache configuration file. A
local attacker could create a specially crafted PHP script that would overwrite
arbitrary files. (CVE-2008-5625)

It was discovered that PHP contained a flaw in the ZipArchive::extractTo
function. If a PHP application were tricked into processing a specially crafted
zip file that had filenames containing "..", an attacker could write arbitrary
files within the filesystem. This issue only applied to Ubuntu 7.10, 8.04 LTS,
and 8.10. (CVE-2008-5658)

USN-557-1 fixed a vulnerability in the GD library. When using the GD library,
PHP did not properly handle the return codes that were added in the security
update. An attacker could exploit this issue with a specially crafted image file
and cause PHP to crash, leading to a denial of service. This issue only applied
to Ubuntu 6.06 LTS, and 7.10. (CVE-2007-3996)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 8.10

• php5-cli - 5.2.6-2ubuntu4.1
• php5-cgi - 5.2.6-2ubuntu4.1
• php5-gd - 5.2.6-2ubuntu4.1
• libapache2-mod-php5 - 5.2.6-2ubuntu4.1
• libapache2-mod-php5filter - 5.2.6-2ubuntu4.1

Ubuntu 8.04

• php5-cli - 5.2.4-2ubuntu5.5
• php5-cgi - 5.2.4-2ubuntu5.5
• php5-gd - 5.2.4-2ubuntu5.5
• libapache2-mod-php5 - 5.2.4-2ubuntu5.5

Ubuntu 7.10

• php5-cli - 5.2.3-1ubuntu6.5
• php5-cgi - 5.2.3-1ubuntu6.5
• php5-gd - 5.2.3-1ubuntu6.5
• libapache2-mod-php5 - 5.2.3-1ubuntu6.5

Ubuntu 6.06

• php5-cli - 5.1.2-1ubuntu3.13
• php5-cgi - 5.1.2-1ubuntu3.13
• php5-gd - 5.1.2-1ubuntu3.13
• libapache2-mod-php5 - 5.1.2-1ubuntu3.13

In general, a standard system upgrade is sufficient to effect the
necessary changes.

References

• CVE-2008-3659
• CVE-2007-5900
• CVE-2007-3996
• CVE-2008-5625
• CVE-2008-5624
• CVE-2008-5557
• CVE-2008-3658
• CVE-2008-3660
• CVE-2008-5658

Related notices

• USN-557-1: libgd2, libgd2-noxpm, libgd2-xpm