概要

Important: php security update

タイプ/重大度

Security Advisory: Important

トピック

Updated PHP packages that fix several security issues are now available for
Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

説明

PHP is an HTML-embedded scripting language commonly used with the Apache
HTTP Web server.

A heap buffer overflow flaw was found in the PHP 'xmlrpc' extension. A
PHP script which implements an XML-RPC server using this extension
could allow a remote attacker to execute arbitrary code as the 'apache'
user. Note that this flaw does not affect PHP applications using the
pure-PHP XML_RPC class provided in /usr/share/pear. (CVE-2007-1864)

A flaw was found in the PHP 'ftp' extension. If a PHP script used this
extension to provide access to a private FTP server, and passed untrusted
script input directly to any function provided by this extension, a remote
attacker would be able to send arbitrary FTP commands to the server.
(CVE-2007-2509)

A buffer overflow flaw was found in the PHP 'soap' extension, regarding the
handling of an HTTP redirect response when using the SOAP client provided
by this extension with an untrusted SOAP server. No mechanism to trigger
this flaw remotely is known. (CVE-2007-2510)

Users of PHP should upgrade to these updated packages which contain
backported patches to correct these issues.

解決法

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

影響を受ける製品

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

修正

• BZ - 239015 - CVE-2007-1864 various PHP security issues (CVE-2007-2509 CVE-2007-2510)

CVE

• CVE-2007-2510
• CVE-2007-1864
• CVE-2007-2509

参考資料

• http://www.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux Server 5

SRPM
ia64
php-5.1.6-12.el5.ia64.rpm	SHA-256: b37a68e176d5f11a76903f625d511a552519bff2a5633d4b97447674b6af90ae
php-bcmath-5.1.6-12.el5.ia64.rpm	SHA-256: 4faf319f67d0e006fb91df0d70e0eafc877c9e3427326ad45346ba48214ca2ba
php-cli-5.1.6-12.el5.ia64.rpm	SHA-256: 74f4cf418b918d25310c14ce4eca511d8f78095333e156ce3f612cffc6e5692f
php-common-5.1.6-12.el5.ia64.rpm	SHA-256: 14be3c1dcc4f3821913310630bf712633621142a8096a1bcbcbc7b21de33094e
php-dba-5.1.6-12.el5.ia64.rpm	SHA-256: e15e51187b73371352a4eab2904b98ecf8fb9c3a9747ee5781ae456665973a6a
php-devel-5.1.6-12.el5.ia64.rpm	SHA-256: cab14427d8fcdbf8c1abec208296caea7dda2222dc0e507aedf09ead60792dbb
php-gd-5.1.6-12.el5.ia64.rpm	SHA-256: 1435ca4e1150d2d61cf1fbabb597ad2e0ec45eeb6d5f994e0e6cb3ae1575b293
php-imap-5.1.6-12.el5.ia64.rpm	SHA-256: 6956626f9173587142c5d4a10e981286035339db161e98e60fb12a0977c84dfc
php-ldap-5.1.6-12.el5.ia64.rpm	SHA-256: 2f06e139c06b54cdad6b14deb09f9a27de8299a8f92a8559e5de4bbd490aba92
php-mbstring-5.1.6-12.el5.ia64.rpm	SHA-256: 3011219045004871d4167884411b3ad83c4036e4f12f037d4a8f02efcf77027e
php-mysql-5.1.6-12.el5.ia64.rpm	SHA-256: c58923482c79a348ee51973a06fcbd0ce8ef3518f6d0caac40783b9c5f3020e5
php-ncurses-5.1.6-12.el5.ia64.rpm	SHA-256: dda73f3094a01be732c5ab7e3b6973c305ffd0ce97ea585369b8245e5957b46c
php-odbc-5.1.6-12.el5.ia64.rpm	SHA-256: 2fe74a874b77b5d8eb84f15aecb6d462fece1e9e0ac063ff8d0b0843d2bc56cd
php-pdo-5.1.6-12.el5.ia64.rpm	SHA-256: 533d8cbaa47b54638666a27f6029e4243799c1f56d41cf2f19aadc0d8e71f3fc
php-pgsql-5.1.6-12.el5.ia64.rpm	SHA-256: 2d36c2be06c3029a0d78706ae35d826d79b15c22f0025836e206b84dcfe6b2fa
php-snmp-5.1.6-12.el5.ia64.rpm	SHA-256: 877e0a082597ad33640a11ef9772aadb1194e6d3daec2066d4d713f12c7de992
php-soap-5.1.6-12.el5.ia64.rpm	SHA-256: 88847efc76f3867c87b6fdb37c85728d8a8d2e9d3ee550332de08309fe9847c2
php-xml-5.1.6-12.el5.ia64.rpm	SHA-256: 706b3ba41a923712e7cb1559e386dfcec7db92a0926b7c925e6af07c339b5036
php-xmlrpc-5.1.6-12.el5.ia64.rpm	SHA-256: 8031bfacd500c047800cd81200e6fb99588bedfe5418f91cda1014f172566023