Synopsis

Moderate: php security update

Type/Severity

Security Advisory: Moderate

Topic

Updated PHP packages that fix several security issues are now available
for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

PHP is an HTML-embedded scripting language commonly used with the Apache
HTTP Web server.

Various integer overflow flaws were found in the PHP gd extension. A script
that could be forced to resize images from an untrusted source could
possibly allow a remote attacker to execute arbitrary code as the apache
user. (CVE-2007-3996)

An integer overflow flaw was found in the PHP chunk_split function. If a
remote attacker was able to pass arbitrary data to the third argument of
chunk_split they could possibly execute arbitrary code as the apache user.
Note that it is unusual for a PHP script to use the chunk_script function
with a user-supplied third argument. (CVE-2007-2872)

A previous security update introduced a bug into PHP session cookie
handling. This could allow an attacker to stop a victim from viewing a
vulnerable web site if the victim has first visited a malicious web page
under the control of the attacker, and that page can set a cookie for the
vulnerable web site. (CVE-2007-4670)

A flaw was found in the PHP money_format function. If a remote attacker
was able to pass arbitrary data to the money_format function this could
possibly result in an information leak or denial of service. Note that is
is unusual for a PHP script to pass user-supplied data to the money_format
function. (CVE-2007-4658)

A flaw was found in the PHP wordwrap function. If a remote attacker was
able to pass arbitrary data to the wordwrap function this could possibly
result in a denial of service. (CVE-2007-3998)

A bug was found in PHP session cookie handling. This could allow an
attacker to create a cross-site cookie insertion attack if a victim follows
an untrusted carefully-crafted URL. (CVE-2007-3799)

An infinite-loop flaw was discovered in the PHP gd extension. A script
that could be forced to process PNG images from an untrusted source could
allow a remote attacker to cause a denial of service. (CVE-2007-2756)

Users of PHP should upgrade to these updated packages, which contain
backported patches to correct these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server - Extended Update Support 4.5 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 4.5 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 4.5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.5 s390
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 242032 - CVE-2007-2872 php chunk_split integer overflow
• BZ - 242033 - CVE-2007-2756 php imagecreatefrompng infinite loop
• BZ - 250726 - CVE-2007-3799 php cross-site cookie insertion
• BZ - 276081 - CVE-2007-3998 php floating point exception inside wordwrap
• BZ - 278011 - CVE-2007-4658 php money_format format string issue
• BZ - 278031 - CVE-2007-3996 php multiple integer overflows in gd
• BZ - 278041 - CVE-2007-4670 php malformed cookie handling

CVEs

• CVE-2007-3996
• CVE-2007-3799
• CVE-2007-3998
• CVE-2007-2872
• CVE-2007-4658
• CVE-2007-2756
• CVE-2007-4670

References

• http://www.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux for Power, big endian 4

SRPM
ppc
php-4.3.9-3.22.9.ppc.rpm	SHA-256: 644e890560cdc0703abe1cec055ff8e0780bbbd29cab2a0aac00623cd80d9d54
php-devel-4.3.9-3.22.9.ppc.rpm	SHA-256: 880a244c242e44e48df5519ac4cd751bf70e68c8df992a4bcf3818c5e7785ba0
php-domxml-4.3.9-3.22.9.ppc.rpm	SHA-256: 34157f506c699e0d7b2c0e59aed65a681721215b0121bcf0d6d36c19992ba48d
php-gd-4.3.9-3.22.9.ppc.rpm	SHA-256: 8af7c533596e79a6d8dab010a6aaae709de94a36c4453d9de9497570929b18a9
php-imap-4.3.9-3.22.9.ppc.rpm	SHA-256: 854a9cd470b74867af713956c843cabc952fbbc20758a3ac88e75c96ea3a7262
php-ldap-4.3.9-3.22.9.ppc.rpm	SHA-256: 1620f5cdfa5dc40ebd6a79d94a93ef08b64d7245b1c4974af82061f51aae4bd4
php-mbstring-4.3.9-3.22.9.ppc.rpm	SHA-256: 371bb4a71573963c3d388be914e581bf6fc7f56774065ee0fce8bbc0c52eb12d
php-mysql-4.3.9-3.22.9.ppc.rpm	SHA-256: 1ac22917b4e64dfff8fc8ddca19e37b519aa29dbf51d01731886a79ccab57945
php-ncurses-4.3.9-3.22.9.ppc.rpm	SHA-256: ab15f0cd2db42c9557b22ba8727d0a70404db12dd741b102ab02132bdda25736
php-odbc-4.3.9-3.22.9.ppc.rpm	SHA-256: 28c573ad2b5ddaab29659b021388dba7a6f7939b61be2365b1ac6cbc681ecf78
php-pear-4.3.9-3.22.9.ppc.rpm	SHA-256: c56ceee0f463b513536b447408cb1e74262c02f4485d7f158ead4b94526bc686
php-pgsql-4.3.9-3.22.9.ppc.rpm	SHA-256: 5236d7b789af785c9b23be1b0b9824b3444f0fd5de9fdca08ca83f115c7a4d56
php-snmp-4.3.9-3.22.9.ppc.rpm	SHA-256: 92aede33aecbe7eceda967ee881ea057d2600e658ac3f37f14420b6343d65e31
php-xmlrpc-4.3.9-3.22.9.ppc.rpm	SHA-256: 484f6e975cdbec145ed83c2b2160bb8f7d28d5681df8f539da0f09f7e100d04c

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.5

SRPM
ppc
php-4.3.9-3.22.9.ppc.rpm	SHA-256: 644e890560cdc0703abe1cec055ff8e0780bbbd29cab2a0aac00623cd80d9d54
php-devel-4.3.9-3.22.9.ppc.rpm	SHA-256: 880a244c242e44e48df5519ac4cd751bf70e68c8df992a4bcf3818c5e7785ba0
php-domxml-4.3.9-3.22.9.ppc.rpm	SHA-256: 34157f506c699e0d7b2c0e59aed65a681721215b0121bcf0d6d36c19992ba48d
php-gd-4.3.9-3.22.9.ppc.rpm	SHA-256: 8af7c533596e79a6d8dab010a6aaae709de94a36c4453d9de9497570929b18a9
php-imap-4.3.9-3.22.9.ppc.rpm	SHA-256: 854a9cd470b74867af713956c843cabc952fbbc20758a3ac88e75c96ea3a7262
php-ldap-4.3.9-3.22.9.ppc.rpm	SHA-256: 1620f5cdfa5dc40ebd6a79d94a93ef08b64d7245b1c4974af82061f51aae4bd4
php-mbstring-4.3.9-3.22.9.ppc.rpm	SHA-256: 371bb4a71573963c3d388be914e581bf6fc7f56774065ee0fce8bbc0c52eb12d
php-mysql-4.3.9-3.22.9.ppc.rpm	SHA-256: 1ac22917b4e64dfff8fc8ddca19e37b519aa29dbf51d01731886a79ccab57945
php-ncurses-4.3.9-3.22.9.ppc.rpm	SHA-256: ab15f0cd2db42c9557b22ba8727d0a70404db12dd741b102ab02132bdda25736
php-odbc-4.3.9-3.22.9.ppc.rpm	SHA-256: 28c573ad2b5ddaab29659b021388dba7a6f7939b61be2365b1ac6cbc681ecf78
php-pear-4.3.9-3.22.9.ppc.rpm	SHA-256: c56ceee0f463b513536b447408cb1e74262c02f4485d7f158ead4b94526bc686
php-pgsql-4.3.9-3.22.9.ppc.rpm	SHA-256: 5236d7b789af785c9b23be1b0b9824b3444f0fd5de9fdca08ca83f115c7a4d56
php-snmp-4.3.9-3.22.9.ppc.rpm	SHA-256: 92aede33aecbe7eceda967ee881ea057d2600e658ac3f37f14420b6343d65e31
php-xmlrpc-4.3.9-3.22.9.ppc.rpm	SHA-256: 484f6e975cdbec145ed83c2b2160bb8f7d28d5681df8f539da0f09f7e100d04c