[Bug 925772] Re: UPDATE REQUEST: php53u 5.3.10 is available upstream

Launchpad Bug Tracker 925772 at bugs.launchpad.net
Thu Feb 9 21:38:05 UTC 2012

This bug was fixed in the package php5 - 5.3.6-13ubuntu3.5

php5 (5.3.6-13ubuntu3.5) oneiric-security; urgency=low

  * SECURITY UPDATE: memory allocation failure denial of service
    - debian/patches/php5-CVE-2011-4153.patch: check result of
      zend_strdup() and calloc() for failed allocations
    - CVE-2011-4153
  * SECURITY UPDATE: predictable hash collision denial of service
    (LP: #910296)
    - debian/patches/php5-CVE-2011-4885.patch: add max_input_vars
      directive with default limit of 1000
    - ATTENTION: this update changes previous php5 behavior by
      limiting the number of external input variables to 1000.
      This may be increased by adding a "max_input_vars"
      directive to the php.ini configuration file. See
      for more information.
    - CVE-2011-4885
  * SECURITY UPDATE: remote code execution vulnerability introduced by
    the fix for CVE-2011-4885 (LP: #925772)
    - debian/patches/php5-CVE-2012-0830.patch: return rather than
      continuing if max_input_vars limit is reached
    - CVE-2012-0830
  * SECURITY UPDATE: XSLT arbitrary file overwrite attack
    - debian/patches/php5-CVE-2012-0057.patch: add xsl.security_prefs
      ini option to define forbidden operations within XSLT stylesheets
    - CVE-2012-0057
  * SECURITY UPDATE: PDORow session denial of service
    - debian/patches/php5-CVE-2012-0788.patch: fail gracefully when
      attempting to serialize PDORow instances
    - CVE-2012-0788
  * SECURITY UPDATE: magic_quotes_gpc remote disable vulnerability
    - debian/patches/php5-CVE-2012-0831.patch: always restore
      magic_quote_gpc on request shutdown
    - CVE-2012-0831
 -- Steve Beattie <sbeattie at ubuntu.com>   Wed, 08 Feb 2012 20:56:28 -0800

** Changed in: php5 (Ubuntu)
       Status: New => Fix Released

** CVE added: http://www.cve.mitre.org/cgi-

** CVE added: http://www.cve.mitre.org/cgi-

** CVE added: http://www.cve.mitre.org/cgi-

** CVE added: http://www.cve.mitre.org/cgi-

** CVE added: http://www.cve.mitre.org/cgi-

You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to php5 in Ubuntu.

  UPDATE REQUEST: php53u 5.3.10 is available upstream

To manage notifications about this bug go to:

More information about the Ubuntu-server-bugs mailing list