Synopsis

Moderate: php security update

Type/Severity

Security Advisory: Moderate

Topic

Updated php packages that fix several security issues are now available for
Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

PHP is an HTML-embedded scripting language commonly used with the Apache
HTTP Web server.

Multiple missing input sanitization flaws were discovered in PHP's exif
extension. A specially-crafted image file could cause the PHP interpreter
to crash or, possibly, disclose portions of its memory when a PHP script
tried to extract Exchangeable image file format (Exif) metadata from the
image file. (CVE-2009-2687, CVE-2009-3292)

A missing input sanitization flaw, leading to a buffer overflow, was
discovered in PHP's gd library. A specially-crafted GD image file could
cause the PHP interpreter to crash or, possibly, execute arbitrary code
when opened. (CVE-2009-3546)

It was discovered that PHP did not limit the maximum number of files that
can be uploaded in one request. A remote attacker could use this flaw to
instigate a denial of service by causing the PHP interpreter to use lots of
system resources dealing with requests containing large amounts of files to
be uploaded. This vulnerability depends on file uploads being enabled
(which it is, in the default PHP configuration). (CVE-2009-4017)

Note: This update introduces a new configuration option, max_file_uploads,
used for limiting the number of files that can be uploaded in one request.
By default, the limit is 20 files per request.

It was discovered that PHP was affected by the previously published "null
prefix attack", caused by incorrect handling of NUL characters in X.509
certificates. If an attacker is able to get a carefully-crafted certificate
signed by a trusted Certificate Authority, the attacker could use the
certificate during a man-in-the-middle attack and potentially confuse PHP
into accepting it by mistake. (CVE-2009-3291)

It was discovered that PHP's htmlspecialchars() function did not properly
recognize partial multi-byte sequences for some multi-byte encodings,
sending them to output without them being escaped. An attacker could use
this flaw to perform a cross-site scripting attack. (CVE-2009-4142)

All php users should upgrade to these updated packages, which contain
backported patches to resolve these issues. After installing the updated
packages, the httpd daemon must be restarted for the update to take effect.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.4 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.4 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.4 i386
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.4 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.8 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 506896 - CVE-2009-2687 php: exif_read_data crash on corrupted JPEG files
• BZ - 524222 - CVE-2009-3292 php: exif extension: Multiple missing sanity checks in EXIF file processing
• BZ - 524228 - CVE-2009-3291 php: openssl extension: Incorrect verification of SSL certificate with NUL in name
• BZ - 529213 - CVE-2009-3546 gd: insufficient input validation in _gdGetColors()
• BZ - 540459 - CVE-2009-4017 PHP: resource exhaustion attack via upload requests with lots of files
• BZ - 548516 - CVE-2009-4142 php: htmlspecialchars() insufficient checking of input for multi-byte encodings

CVEs

• CVE-2009-2687
• CVE-2009-3546
• CVE-2009-4142
• CVE-2009-4017
• CVE-2009-3292
• CVE-2009-3291

References

• http://www.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 5

SRPM
x86_64
php-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 91c9c1c0d27898205519ae5a2cb5ba5f878d389cd68b2cdbbc3c4a175e43ca23
php-bcmath-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 536356b62ae152006f8d2e8ce397201c1cb3672d59169634e99029e4a016f502
php-cli-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 6f9c47d1208af45e817a514205fbef850f15ca789cb5c260bc60357b2ed398e3
php-common-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: aa9439b36d1efd579a26d000846d8fbfe315b4c96fc54ae34325cb2d3c2b0a94
php-dba-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 8673e71f86c80eb0295330c5dc88efdd3bc91a539867553bab0f159cab8dc735
php-devel-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 72593464f6066757ccad5bf076bb02ea74ca6f96eced40813f6a0e25ee5bcece
php-gd-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: ef1905a50f4862c39ed30eb0f576705889876b4825db4672a6ec5bd418a3fe84
php-imap-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 733daa1530a6c07abea37662155374f5bb5914ad5a6299d97401c6358c27c3c5
php-ldap-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 53b31b6d113da033058e24aa2a097c9a92250bbaf977caf67f4114706f035b0a
php-mbstring-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 802adb73adb003469d6ab0614e632adef2393c4677bf10d2d82e4d997549e6a2
php-mysql-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: a7618d23f832eb018e43fe4c5d56d0079808513ce9668fcca65401d5940dadc3
php-ncurses-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 2845d68105a1c3828f327ee9e7cb60c519ed37820bdc614f97a72b0bf19dc6b8
php-odbc-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 06ca09d175db830ff47bacd08d600f60976693711e58eebb6dd3c4480721f34d
php-pdo-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 1bc9318e7ea77bf910c42756631da61e9d8de1d3730bb45a08e746e3cb6645ef
php-pgsql-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 4c8dd2b24d2541c8e9719f64d1fbe4b76fd1d436ee6332119e091eda0d3c3fc8
php-snmp-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 1676f8cc4cbe22adf2c1cb8809838b7a4c4a42aa703ed5b5e5e1e8e960b19be4
php-soap-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 81a48757a721cdf5eeeeb046e722f7c0e028fef721be8c4f50dd1ecd666f0a7a
php-xml-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: c73609e056b8243ba88b7f7ca60816e34fc3ca4f7e313e2e1d09f721020d6e7a
php-xmlrpc-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 5afa53d2d50b1ee8d46f89634632c0b0c51126cce0f48d3112264850cbee29c8

Red Hat Enterprise Linux Workstation 5

SRPM
x86_64
php-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 91c9c1c0d27898205519ae5a2cb5ba5f878d389cd68b2cdbbc3c4a175e43ca23
php-bcmath-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 536356b62ae152006f8d2e8ce397201c1cb3672d59169634e99029e4a016f502
php-cli-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 6f9c47d1208af45e817a514205fbef850f15ca789cb5c260bc60357b2ed398e3
php-common-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: aa9439b36d1efd579a26d000846d8fbfe315b4c96fc54ae34325cb2d3c2b0a94
php-dba-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 8673e71f86c80eb0295330c5dc88efdd3bc91a539867553bab0f159cab8dc735
php-devel-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 72593464f6066757ccad5bf076bb02ea74ca6f96eced40813f6a0e25ee5bcece
php-gd-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: ef1905a50f4862c39ed30eb0f576705889876b4825db4672a6ec5bd418a3fe84
php-imap-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 733daa1530a6c07abea37662155374f5bb5914ad5a6299d97401c6358c27c3c5
php-ldap-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 53b31b6d113da033058e24aa2a097c9a92250bbaf977caf67f4114706f035b0a
php-mbstring-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 802adb73adb003469d6ab0614e632adef2393c4677bf10d2d82e4d997549e6a2
php-mysql-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: a7618d23f832eb018e43fe4c5d56d0079808513ce9668fcca65401d5940dadc3
php-ncurses-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 2845d68105a1c3828f327ee9e7cb60c519ed37820bdc614f97a72b0bf19dc6b8
php-odbc-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 06ca09d175db830ff47bacd08d600f60976693711e58eebb6dd3c4480721f34d
php-pdo-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 1bc9318e7ea77bf910c42756631da61e9d8de1d3730bb45a08e746e3cb6645ef
php-pgsql-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 4c8dd2b24d2541c8e9719f64d1fbe4b76fd1d436ee6332119e091eda0d3c3fc8
php-snmp-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 1676f8cc4cbe22adf2c1cb8809838b7a4c4a42aa703ed5b5e5e1e8e960b19be4
php-soap-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 81a48757a721cdf5eeeeb046e722f7c0e028fef721be8c4f50dd1ecd666f0a7a
php-xml-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: c73609e056b8243ba88b7f7ca60816e34fc3ca4f7e313e2e1d09f721020d6e7a
php-xmlrpc-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 5afa53d2d50b1ee8d46f89634632c0b0c51126cce0f48d3112264850cbee29c8

Red Hat Enterprise Linux Server from RHUI 5

SRPM
x86_64
php-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 91c9c1c0d27898205519ae5a2cb5ba5f878d389cd68b2cdbbc3c4a175e43ca23
php-bcmath-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 536356b62ae152006f8d2e8ce397201c1cb3672d59169634e99029e4a016f502
php-cli-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 6f9c47d1208af45e817a514205fbef850f15ca789cb5c260bc60357b2ed398e3
php-common-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: aa9439b36d1efd579a26d000846d8fbfe315b4c96fc54ae34325cb2d3c2b0a94
php-dba-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 8673e71f86c80eb0295330c5dc88efdd3bc91a539867553bab0f159cab8dc735
php-devel-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 72593464f6066757ccad5bf076bb02ea74ca6f96eced40813f6a0e25ee5bcece
php-gd-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: ef1905a50f4862c39ed30eb0f576705889876b4825db4672a6ec5bd418a3fe84
php-imap-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 733daa1530a6c07abea37662155374f5bb5914ad5a6299d97401c6358c27c3c5
php-ldap-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 53b31b6d113da033058e24aa2a097c9a92250bbaf977caf67f4114706f035b0a
php-mbstring-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 802adb73adb003469d6ab0614e632adef2393c4677bf10d2d82e4d997549e6a2
php-mysql-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: a7618d23f832eb018e43fe4c5d56d0079808513ce9668fcca65401d5940dadc3
php-ncurses-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 2845d68105a1c3828f327ee9e7cb60c519ed37820bdc614f97a72b0bf19dc6b8
php-odbc-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 06ca09d175db830ff47bacd08d600f60976693711e58eebb6dd3c4480721f34d
php-pdo-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 1bc9318e7ea77bf910c42756631da61e9d8de1d3730bb45a08e746e3cb6645ef
php-pgsql-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 4c8dd2b24d2541c8e9719f64d1fbe4b76fd1d436ee6332119e091eda0d3c3fc8
php-snmp-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 1676f8cc4cbe22adf2c1cb8809838b7a4c4a42aa703ed5b5e5e1e8e960b19be4
php-soap-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 81a48757a721cdf5eeeeb046e722f7c0e028fef721be8c4f50dd1ecd666f0a7a
php-xml-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: c73609e056b8243ba88b7f7ca60816e34fc3ca4f7e313e2e1d09f721020d6e7a
php-xmlrpc-5.1.6-24.el5_4.5.x86_64.rpm	SHA-256: 5afa53d2d50b1ee8d46f89634632c0b0c51126cce0f48d3112264850cbee29c8