Avis du CERT RENATER

Par défaut, cette page vous affichera les derniers messages envoyés par le CERT RENATER à la communauté. Vous pouvez affiner par année ou par type de message. Si aucun critère n'est précisé, seuls les derniers messages sont affichés
Date : Tue, 20 Dec 2011 16:17:08 +0100
Type : VULN
Sujet : CERT-Renater : 2011/VULN661 (PHP : PHP 5.2.12 fixes security vulnerabilities)
====================================================================
                                     CERT-Renater

                          Note d'Information No. 2011/VULN661
_____________________________________________________________________

DATE                : 20/12/2011

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S) : Systems running PHP versions prior to 5.2.12.

======================================================================
http://news.php.net/php.announce/80
______________________________________________________________________

The PHP development team would like to announce the immediate
availability of PHP 5.2.12. This release focuses on improving the
stability of the PHP 5.2.x branch with over 60 bug fixes, some of which
are security related.  All users of PHP 5.2 are encouraged to upgrade to
this release.

Security Enhancements and Fixes in PHP 5.2.12:

- Fixed a safe_mode bypass in tempnam() identified by Grzegorz
Stachowiak. (CVE-2009-3557, Rasmus)
- Fixed a open_basedir bypass in posix_mkfifo() identified by Grzegorz
Stachowiak. (CVE-2009-3558, Rasmus)
- Added "max_file_uploads" INI directive, which can be set to limit the
number of file uploads per-request to 20 by default, to prevent possible
DOS via temporary file exhaustion, identified by Bogdan Calin.
(CVE-2009-4017, Ilia)
- Added protection for $_SESSION from interrupt corruption and improved
"session.save_path" check, identified by Stefan Esser. (CVE-2009-4143, Stas)
- Fixed bug #49785 (insufficient input string validation of
htmlspecialchars()). (CVE-2009-4142, Moriyoshi, hello at iwamot dot com)

Key enhancements in PHP 5.2.12 include:

- Fixed unnecessary invocation of setitimer when timeouts have been
disabled. (Arvind Srinivasan)
- Fixed crash in com_print_typeinfo when an invalid typelib is given.
(Pierre)
- Fixed crash in SQLiteDatabase::ArrayQuery() and
SQLiteDatabase::SingleQuery() when calling using Reflection. (Felipe)
- Fixed crash when instantiating PDORow and PDOStatement through
Reflection. (Felipe)
- Fixed memory leak in openssl_pkcs12_export_to_file(). (Felipe)
- Fixed bug #50207 (segmentation fault when concatenating very large
strings on 64bit linux). (Ilia)
- Fixed bug #50162 (Memory leak when fetching timestamp column from
Oracle database). (Felipe)
- Fixed bug #50006 (Segfault caused by uksort()). (Felipe)
- Fixed bug #50005 (Throwing through Reflection modified Exception
object makes segmentation fault). (Felipe)
- Fixed bug #49174 (crash when extending PDOStatement and trying to set
queryString property). (Felipe)
- Fixed bug #49098 (mysqli segfault on error). (Rasmus)
- Over 50 other bug fixes.


Ilia Alshanetsky
5.2 Release Master



======================================================================

            =========================================================
            Les serveurs de référence du CERT-Renater
            http://www.urec.fr/securite
            http://www.cru.fr/securite
            http://www.renater.fr
            =========================================================
            + CERT-RENATER          | tel : 01-53-94-20-44          +
            + 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
            + 75013 Paris           | email: certsvp@renater.fr     +
            =========================================================

[An attachment of type application/pkcs7-signature was included here]