RHBA-2009:1013 - Bug Fix Advisory

Topic

Updated php packages that fix several bugs and add various enhancements are
now available.

Description

PHP is an HTML-embedded scripting language commonly used with the Apache
HTTP Web server.

These updated php packages provide fixes for the following bugs:

• PHP's "serialize" function did not correctly handle incomplete classes,

which could have led to segmentation faults in the httpd server.

• in certain cases, using PHP's "setlocale" function could cause the httpd

server to segmentation fault.

• a number of functions in the odbc extension were not 64-bit safe, which

led to segmentation faults when running on 64-bit architectures.

• positional arguments in "printf" format strings were not interpreted in

the correct order, which led to "printf(): Too few arguments" warning messages.

• the gd extension contained an incorrect RPATH.
• the fgetcsv() function returned incorrect data for CSV files which

contained certain quoting patterns.

• calling the curl_init() function with an invalid argument caused the

process to segmentation fault.

• the php-devel package now lists both autoconf and automake in its Requires.
• interrupted or aborted file uploads led to an incorrect error status in

the "$_FILES" array.

• several functions in PHP's "gmp" (GNU Multiple Precision) extension gave

incorrect results when supplied an operand that was zero (0) in value.

• if a stream which used a custom stream wrapper was not closed when a

script terminated, the process could crash.

In addition, these updated packages provide the following enhancements:

• these updated packages now include support for the "dbase" extension.
• these updated packages now provide the "mod_php" virtual provide for

forward-compatibility with later versions of Red Hat Enterprise Linux.

Users are advised to upgrade to these updated php packages, which resolve
these issues and add these enhancements.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 165194 - function fgetcsv parse failed
• BZ - 176715 - PHP Segfaults when using curl_init and uninialized variables
• BZ - 203151 - php segmentation fault on setlocale function
• BZ - 211609 - php-odbc is not 64-bit clean
• BZ - 218044 - Backport printf handling bug from upstream
• BZ - 219235 - serializer issue with incomplete class
• BZ - 236094 - RFE: enable dbase extension for php
• BZ - 294611 - provide: mod_php for forwards-compat
• BZ - 315511 - incorrect values from GMP functions in PHP
• BZ - 433558 - segmentation fault when the stream with a wrapper is not closed
• BZ - 453028 - php-devel should Require autoconf, automake

CVEs

(none)

References

(none)