RHBA-2010:0241 - Bug Fix Advisory

Topic

Updated php packages that fix various bugs and add enhancements are now
available.

Description

PHP is an HTML-embedded scripting language that allows developers to write
dynamically generated web pages. PHP is ideal for writing database-enabled
websites, with built-in integration for several commercial and non-
commercial database management systems. PHP is often used as a replacement
for CGI scripts.

The php package contains a module that adds support for the PHP language to
the Apache HTTP Server.

• two minor fixes were performed in the php substr_compare and substr_count

functions to correct integer overflows. (BZ#469807 & BZ#470971)

• if a PHP script uses odbc_connect and the -lodbcpsql is being used for

PostgreSQL, it will either hang forever or cause a segmentation fault. The
default behavior was changed, and the hangs and errors no longer occur.
(BZ#483690)

• the default PHP build was not thread-safe, and became unusable with the

worker MPM in httpd. It was upgraded to be thread-safe and can now be used
as expected. (BZ#484058)

• when an unsupported character set was used, the PHP mbstring module would

experience a segmentation fault. A patch was added to resolve a double-free
problem, and the segfault no longer occurs. (BZ#486651)

• when rebuilding PHP on IBM PowerPC architecture, the build would fail. A

change was made to the PHP specfile, and a rebuild now works as expected.
(BZ#491050)

• the PHP move_uploaded_file function was generating inconsistent

destination file permissions. The destination file's permissions are
now always determined by the active umask and permissions are now
consistent. (BZ#498031)

• some PHP code was creating invalid pointer errors and stack traces. The

package was updated so that an entry is added to the log file, and no error
occurs. (BZ#515372)

• the default memory_limit value was too low for some 64-bit

architectures. The user needed to manually edit the php.ini file to be
able to start Apache. The default value has been increased to 128M and
Apache now starts as expected on 64-bit hardware. (BZ#517604)

• when attempting to build Zarafa a syntax error caused the build to fail.

Extraneous keystrokes were removed and Zarafa now builds as expected.
(BZ#530824)

• the PHP package has been updated to include new code from upstream.

(BZ#500383, BZ#505355, & BZ#511175)

Users are advised to upgrade to these updated php packages, which resolve
these issues and add these enhancements.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 483690 - PHP odbc with UnixODBC causes hang or Segfault when driver changes
• BZ - 484058 - Thread-safe php build
• BZ - 486651 - Reproducible segmentation fault with php mbstring module
• BZ - 491050 - failed to rebuild on ppc arch for EL5
• BZ - 498031 - php function move_uploaded_file ignores umask setting
• BZ - 500383 - PHP's SOAP bug fixed in 5.2.0 upstream, not backported
• BZ - 505355 - Reference counting bug in SoapClient::__setSoapHeaders()
• BZ - 511175 - PHP SOAP request generated with empty tag for NULL variables
• BZ - 530824 - php_stream_filter_api.h:65: error: comma at end of enumerator list

CVEs

(none)

References

(none)