[ubuntu/karmic-security] php5_5.2.10.dfsg.1-2ubuntu6.9_amd64_translations.tar.gz, php5_5.2.10.dfsg.1-2ubuntu6.9_ia64_translations.tar.gz, php5_5.2.10.dfsg.1-2ubuntu6.9_powerpc_translations.tar.gz, php5_5.2.10.dfsg.1-2ubuntu6.9_lpia_translations.tar.gz, php5_5.2.10.dfsg.1-2ubuntu6.9_sparc_translations.tar.gz (delayed), php5, php5_5.2.10.dfsg.1-2ubuntu6.9_armel_translations.tar.gz, php5_5.2.10.dfsg.1-2ubuntu6.9_i386_translations.tar.gz 5.2.10.dfsg.1-2ubuntu6.9 (Accepted)
Ubuntu Installer
archive at ubuntu.com
Fri Apr 29 06:05:10 UTC 2011
php5 (5.2.10.dfsg.1-2ubuntu6.9) karmic-security; urgency=low
* SECURITY UPDATE: arbitrary files removal via cronjob
- debian/php5-common.php5.cron.d: take greater care when removing
session files.
- http://git.debian.org/?p=pkg-php%2Fphp.git;a=commitdiff_plain;h=d09fd04ed7bfcf7f008360c6a42025108925df09
- CVE-2011-0441
* SECURITY UPDATE: symlink tmp races in pear install
- debian/patches/php5-pear-CVE-2011-1072.patch: improved
tempfile handling.
- debian/rules: apply patch manually after unpacking PEAR phar
archive.
- CVE-2011-1072
* SECURITY UPDATE: more symlink races in pear install
- debian/patches/php5-pear-CVE-2011-1144.patch: add TOCTOU save
file handler.
- debian/rules: apply patch manually after unpacking PEAR phar
archive.
- CVE-2011-1144
* SECURITY UPDATE: use-after-free vulnerability
- debian/patches/php5-CVE-2010-4697.patch: retain reference to
object until getter/setter are done.
- CVE-2010-4697
* SECURITY UPDATE: denial of service through application crash with
invalid images
- debian/patches/php5-CVE-2010-4698.patch: verify anti-aliasing
steps are either 4 or 16.
- CVE-2010-4698
* SECURITY UPDATE: denial of service through application crash
- debian/patches/php5-CVE-2011-0421.patch: fail operation gracefully
when handling zero sized zipfile with the FL_UNCHANGED argument
- CVE-2011-0421
* SECURITY UPDATE: denial of service through application crash when
handling images with invalid exif tags
- debian/patches/php5-CVE-2011-0708.patch: stricter exif checking
- CVE-2011-0708
* SECURITY UPDATE: denial of service and possible data disclosure
through integer overflow
- debian/patches/php5-CVE-2011-1092.patch: better boundary
condition checks in shmop_read()
- CVE-2011-1092
* SECURITY UPDATE: use-after-free vulnerability
- debian/patches/php5-CVE-2011-1148.patch: improve reference
counting
- CVE-2011-1148
* SECURITY UPDATE: denial of service through buffer overflow crash
(code execution mitigated by compilation with Fortify Source)
- debian/patches/php5-CVE-2011-1464.patch: limit amount of precision
to ensure fitting within MAX_BUF_SIZE
- CVE-2011-1464
* SECURITY UPDATE: denial of service through application crash via
integer overflow.
- debian/patches/php5-CVE-2011-1466.patch: improve boundary
condition checking in SdnToJulian()
- CVE-2011-1466
* SECURITY UPDATE: denial of service through application crash
when using HTTP proxy with the FTP wrapper
- debian/patches/php5-CVE-2011-1469.patch: improve pointer handling
- CVE-2011-1469
* SECURITY UPDATE: denial of service through application crash when
handling ziparchive streams
- debian/patches/php5-CVE-2011-1470.patch: set necessary elements of
the meta data structure
- CVE-2011-1470
* SECURITY UPDATE: denial of service through application crash when
handling malformed zip files
- debian/patches/php5-CVE-2011-1471.patch: correct integer
signedness error when handling zip_fread() return value.
- CVE-2011-1471
Date: Thu, 28 Apr 2011 05:37:29 -0700
Changed-By: Steve Beattie <sbeattie at ubuntu.com>
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
https://launchpad.net/ubuntu/karmic/+source/php5/5.2.10.dfsg.1-2ubuntu6.9
-------------- next part --------------
Format: 1.8
Date: Thu, 28 Apr 2011 05:37:29 -0700
Source: php5
Binary: php5 php5-common libapache2-mod-php5 libapache2-mod-php5filter php5-cgi php5-cli php5-dev php5-dbg php-pear php5-curl php5-gd php5-gmp php5-ldap php5-mhash php5-mysql php5-odbc php5-pgsql php5-pspell php5-recode php5-snmp php5-sqlite php5-sybase php5-tidy php5-xmlrpc php5-xsl
Architecture: source
Version: 5.2.10.dfsg.1-2ubuntu6.9
Distribution: karmic-security
Urgency: low
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: Steve Beattie <sbeattie at ubuntu.com>
Description:
libapache2-mod-php5 - server-side, HTML-embedded scripting language (Apache 2 module)
libapache2-mod-php5filter - server-side, HTML-embedded scripting language (apache 2 filter mo
php-pear - PEAR - PHP Extension and Application Repository
php5 - server-side, HTML-embedded scripting language (metapackage)
php5-cgi - server-side, HTML-embedded scripting language (CGI binary)
php5-cli - command-line interpreter for the php5 scripting language
php5-common - Common files for packages built from the php5 source
php5-curl - CURL module for php5
php5-dbg - Debug symbols for PHP5
php5-dev - Files for PHP5 module development
php5-gd - GD module for php5
php5-gmp - GMP module for php5
php5-ldap - LDAP module for php5
php5-mhash - MHASH module for php5
php5-mysql - MySQL module for php5
php5-odbc - ODBC module for php5
php5-pgsql - PostgreSQL module for php5
php5-pspell - pspell module for php5
php5-recode - recode module for php5
php5-snmp - SNMP module for php5
php5-sqlite - SQLite module for php5
php5-sybase - Sybase / MS SQL Server module for php5
php5-tidy - tidy module for php5
php5-xmlrpc - XML-RPC module for php5
php5-xsl - XSL module for php5
Changes:
php5 (5.2.10.dfsg.1-2ubuntu6.9) karmic-security; urgency=low
.
* SECURITY UPDATE: arbitrary files removal via cronjob
- debian/php5-common.php5.cron.d: take greater care when removing
session files.
- http://git.debian.org/?p=pkg-php%2Fphp.git;a=commitdiff_plain;h=d09fd04ed7bfcf7f008360c6a42025108925df09
- CVE-2011-0441
* SECURITY UPDATE: symlink tmp races in pear install
- debian/patches/php5-pear-CVE-2011-1072.patch: improved
tempfile handling.
- debian/rules: apply patch manually after unpacking PEAR phar
archive.
- CVE-2011-1072
* SECURITY UPDATE: more symlink races in pear install
- debian/patches/php5-pear-CVE-2011-1144.patch: add TOCTOU save
file handler.
- debian/rules: apply patch manually after unpacking PEAR phar
archive.
- CVE-2011-1144
* SECURITY UPDATE: use-after-free vulnerability
- debian/patches/php5-CVE-2010-4697.patch: retain reference to
object until getter/setter are done.
- CVE-2010-4697
* SECURITY UPDATE: denial of service through application crash with
invalid images
- debian/patches/php5-CVE-2010-4698.patch: verify anti-aliasing
steps are either 4 or 16.
- CVE-2010-4698
* SECURITY UPDATE: denial of service through application crash
- debian/patches/php5-CVE-2011-0421.patch: fail operation gracefully
when handling zero sized zipfile with the FL_UNCHANGED argument
- CVE-2011-0421
* SECURITY UPDATE: denial of service through application crash when
handling images with invalid exif tags
- debian/patches/php5-CVE-2011-0708.patch: stricter exif checking
- CVE-2011-0708
* SECURITY UPDATE: denial of service and possible data disclosure
through integer overflow
- debian/patches/php5-CVE-2011-1092.patch: better boundary
condition checks in shmop_read()
- CVE-2011-1092
* SECURITY UPDATE: use-after-free vulnerability
- debian/patches/php5-CVE-2011-1148.patch: improve reference
counting
- CVE-2011-1148
* SECURITY UPDATE: denial of service through buffer overflow crash
(code execution mitigated by compilation with Fortify Source)
- debian/patches/php5-CVE-2011-1464.patch: limit amount of precision
to ensure fitting within MAX_BUF_SIZE
- CVE-2011-1464
* SECURITY UPDATE: denial of service through application crash via
integer overflow.
- debian/patches/php5-CVE-2011-1466.patch: improve boundary
condition checking in SdnToJulian()
- CVE-2011-1466
* SECURITY UPDATE: denial of service through application crash
when using HTTP proxy with the FTP wrapper
- debian/patches/php5-CVE-2011-1469.patch: improve pointer handling
- CVE-2011-1469
* SECURITY UPDATE: denial of service through application crash when
handling ziparchive streams
- debian/patches/php5-CVE-2011-1470.patch: set necessary elements of
the meta data structure
- CVE-2011-1470
* SECURITY UPDATE: denial of service through application crash when
handling malformed zip files
- debian/patches/php5-CVE-2011-1471.patch: correct integer
signedness error when handling zip_fread() return value.
- CVE-2011-1471
Checksums-Sha1:
1d5b29a4ecbbea067e9b256d230fa1010c10c49c 3165 php5_5.2.10.dfsg.1-2ubuntu6.9.dsc
65ed269ae661bf7c4f1d0752b40db7e87019dfde 996525 php5_5.2.10.dfsg.1-2ubuntu6.9.diff.gz
Checksums-Sha256:
9c79d89902f9a7df8c06b42bfa1a9a52141c723797d522df41241037e006c358 3165 php5_5.2.10.dfsg.1-2ubuntu6.9.dsc
2adb7b3e70e394dd8c34811bff29ef8e3579c9240eca1799593917cd29378245 996525 php5_5.2.10.dfsg.1-2ubuntu6.9.diff.gz
Files:
b10d7914090cf20ab35ae270d430a88e 3165 php optional php5_5.2.10.dfsg.1-2ubuntu6.9.dsc
6de24534da33b686d675ccf3f5bde0f7 996525 php optional php5_5.2.10.dfsg.1-2ubuntu6.9.diff.gz
Original-Maintainer: Debian PHP Maintainers <pkg-php-maint at lists.alioth.debian.org>
More information about the Karmic-changes
mailing list