[ubuntu/lucid-updates] php5 5.3.2-1ubuntu4.28 (Accepted)
Ubuntu Archive Robot
cjwatson+ubuntu-archive-robot at chiark.greenend.org.uk
Thu Oct 30 12:29:19 UTC 2014
php5 (5.3.2-1ubuntu4.28) lucid-security; urgency=medium
* SECURITY UPDATE: denial of service via buffer overflow in mkgmtime()
- debian/patches/CVE-2014-3668.patch: properly handle sizes in
ext/xmlrpc/libxmlrpc/xmlrpc.c, added test to
ext/xmlrpc/tests/bug68027.phpt.
- CVE-2014-3668
* SECURITY UPDATE: integer overflow in unserialize()
- debian/patches/CVE-2014-3669.patch: fix overflow in
ext/standard/var_unserializer.{c,re}, added test to
ext/standard/tests/serialize/bug68044.phpt.
- CVE-2014-3669
* SECURITY UPDATE: Heap corruption in exif_thumbnail()
- debian/patches/CVE-2014-3670.patch: fix sizes in ext/exif/exif.c.
- CVE-2014-3670
* SECURITY UPDATE: out of bounds read in elf note headers in fileinfo()
- debian/patches/CVE-2014-3710.patch: validate note headers in
ext/fileinfo/libmagic/readelf.c.
- CVE-2014-3710
* SECURITY UPDATE: local file disclosure via curl NULL byte injection
- debian/patches/curl_embedded_null.patch: don't accept curl options
with embedded NULLs in ext/curl/interface.c, added test to
ext/curl/tests/bug68089.phpt.
- No CVE number
Date: 2014-10-29 11:45:12.934322+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
Signed-By: Ubuntu Archive Robot <cjwatson+ubuntu-archive-robot at chiark.greenend.org.uk>
https://launchpad.net/ubuntu/lucid/+source/php5/5.3.2-1ubuntu4.28
-------------- next part --------------
Sorry, changesfile not available.
More information about the Lucid-changes
mailing list