Synopsis

Critical: php53 security update

Type/Severity

Security Advisory: Critical

Topic

Updated php53 packages that fix one security issue are now available for
Red Hat Enterprise Linux 5.6 and 5.9 Extended Update Support.

The Red Hat Security Response Team has rated this update as having critical
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

PHP is an HTML-embedded scripting language commonly used with the Apache
HTTP Server.

A memory corruption flaw was found in the way the openssl_x509_parse()
function of the PHP openssl extension parsed X.509 certificates. A remote
attacker could use this flaw to provide a malicious self-signed certificate
or a certificate signed by a trusted authority to a PHP application using
the aforementioned function, causing the application to crash or, possibly,
allow the attacker to execute arbitrary code with the privileges of the
user running the PHP interpreter. (CVE-2013-6420)

Red Hat would like to thank the PHP project for reporting this issue.
Upstream acknowledges Stefan Esser as the original reporter of this issue.

All php53 users are advised to upgrade to these updated packages, which
contain a backported patch to correct this issue. After installing the
updated packages, the httpd daemon must be restarted for the update to
take effect.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat Enterprise Linux Server - Extended Update Support 5.9 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.9 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.9 i386
• Red Hat Enterprise Linux Server - Extended Update Support 5.6 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.6 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.6 i386
• Red Hat Enterprise Linux Server - AUS 5.9 x86_64
• Red Hat Enterprise Linux Server - AUS 5.9 ia64
• Red Hat Enterprise Linux Server - AUS 5.6 x86_64
• Red Hat Enterprise Linux Server - AUS 5.6 i386
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.9 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.6 s390x
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.9 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.6 ppc
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.9 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.9 i386
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6 i386
• Red Hat Enterprise Linux Server - AUS 5.9 i386
• Red Hat Enterprise Linux Server - AUS 5.6 ia64

Fixes

• BZ - 1036830 - CVE-2013-6420 php: memory corruption in openssl_x509_parse()

CVEs

• CVE-2013-6420

References

• https://access.redhat.com/security/updates/classification/#critical

Red Hat Enterprise Linux Server - Extended Update Support 5.6

SRPM
x86_64
php53-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 2aa0ef270f08029caba0a5df2cf398fe9cea065117bef3fec1a1fa4b30340e51
php53-bcmath-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: f58ef4fe22f5c829de1ecd3921188e8f1d7a886ab62975cdf954ceb4b5fe0f2d
php53-cli-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: e2dcfd6b56ceb94093fc624a3b1598dc071df53b5814d1746cbee023b988a7e4
php53-common-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: aad1aeb2f57840daff4f8079f15196769f96039a6e4d8dda552ee710753f1d73
php53-dba-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 5c65e63da595bcff533820f081728ba5715cb58428d3711dc18bf34a0efb8e54
php53-devel-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: de6c54f46553334b46ae3537fc615bd4558dd4a7bc29c4a700d239760d33bc87
php53-gd-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 28289c206a3d1f3b392ef971a9ebcc4d8f2da385e15d1c904eed757c8c01621f
php53-imap-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 730d04eb4de0698f0ce8e069e22114f1d8b5b6bdc289adb708e750e5de42acf2
php53-intl-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: f8d82e72886a4637d068dd1d899dc948789e92863f342a01c8ce25bbd91e3036
php53-ldap-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: e6941ec67b79e4df96fe585d464ed9a3abffc3aa0f3022857ff948380db26447
php53-mbstring-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 50d737f404ffb81e7709b79db2a0c2e943f13dac2f940d3b068f380caa903cf4
php53-mysql-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 7fe51c0c85235a2a38100500d90f7881620c00dd8ba1c3fc18bb358bc57cbc01
php53-odbc-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: c34b121cade4b384326e14a48e7c9b642345bb16f8dee3c184eecd0630f66258
php53-pdo-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: cdd50ae59c4d882f75313c00ab1ffc87730427bd1804aee602f3b523de931748
php53-pgsql-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 687b9c07e02417ee33d64cb48b427fd55584319d6518c194c66c02a27e663e64
php53-process-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 66b10dbd1b837c07830d56498555b9b32ddb6e23d960351475ae5c2815a39b43
php53-pspell-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: b6d2bb41cec9198bfd2bfcfce74ec16f30519b631c8d7a0429265a3f6614654a
php53-snmp-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 30bb1ef15871fb647a5d625ac7f8672ac2abae742d63f92cf6273b415f88bd6f
php53-soap-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 2598e0765b67e8e68323f6ef196a6843fc5a8fdd8c2643d0534bf444e0b081f3
php53-xml-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 074d2a75eb8d80dc283af57ba619a26adad242db043d096b054b0a65d92a75df
php53-xmlrpc-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 78b6fd85d69812fb39a3ec02f1f72bbbb703ce3ffaeae45d27dd5acea53178f1

Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6

SRPM
x86_64
php53-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 2aa0ef270f08029caba0a5df2cf398fe9cea065117bef3fec1a1fa4b30340e51
php53-bcmath-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: f58ef4fe22f5c829de1ecd3921188e8f1d7a886ab62975cdf954ceb4b5fe0f2d
php53-cli-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: e2dcfd6b56ceb94093fc624a3b1598dc071df53b5814d1746cbee023b988a7e4
php53-common-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: aad1aeb2f57840daff4f8079f15196769f96039a6e4d8dda552ee710753f1d73
php53-dba-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 5c65e63da595bcff533820f081728ba5715cb58428d3711dc18bf34a0efb8e54
php53-devel-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: de6c54f46553334b46ae3537fc615bd4558dd4a7bc29c4a700d239760d33bc87
php53-gd-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 28289c206a3d1f3b392ef971a9ebcc4d8f2da385e15d1c904eed757c8c01621f
php53-imap-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 730d04eb4de0698f0ce8e069e22114f1d8b5b6bdc289adb708e750e5de42acf2
php53-intl-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: f8d82e72886a4637d068dd1d899dc948789e92863f342a01c8ce25bbd91e3036
php53-ldap-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: e6941ec67b79e4df96fe585d464ed9a3abffc3aa0f3022857ff948380db26447
php53-mbstring-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 50d737f404ffb81e7709b79db2a0c2e943f13dac2f940d3b068f380caa903cf4
php53-mysql-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 7fe51c0c85235a2a38100500d90f7881620c00dd8ba1c3fc18bb358bc57cbc01
php53-odbc-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: c34b121cade4b384326e14a48e7c9b642345bb16f8dee3c184eecd0630f66258
php53-pdo-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: cdd50ae59c4d882f75313c00ab1ffc87730427bd1804aee602f3b523de931748
php53-pgsql-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 687b9c07e02417ee33d64cb48b427fd55584319d6518c194c66c02a27e663e64
php53-process-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 66b10dbd1b837c07830d56498555b9b32ddb6e23d960351475ae5c2815a39b43
php53-pspell-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: b6d2bb41cec9198bfd2bfcfce74ec16f30519b631c8d7a0429265a3f6614654a
php53-snmp-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 30bb1ef15871fb647a5d625ac7f8672ac2abae742d63f92cf6273b415f88bd6f
php53-soap-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 2598e0765b67e8e68323f6ef196a6843fc5a8fdd8c2643d0534bf444e0b081f3
php53-xml-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 074d2a75eb8d80dc283af57ba619a26adad242db043d096b054b0a65d92a75df
php53-xmlrpc-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 78b6fd85d69812fb39a3ec02f1f72bbbb703ce3ffaeae45d27dd5acea53178f1

Red Hat Enterprise Linux Server - AUS 5.6

SRPM
x86_64
php53-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 2aa0ef270f08029caba0a5df2cf398fe9cea065117bef3fec1a1fa4b30340e51
php53-bcmath-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: f58ef4fe22f5c829de1ecd3921188e8f1d7a886ab62975cdf954ceb4b5fe0f2d
php53-cli-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: e2dcfd6b56ceb94093fc624a3b1598dc071df53b5814d1746cbee023b988a7e4
php53-common-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: aad1aeb2f57840daff4f8079f15196769f96039a6e4d8dda552ee710753f1d73
php53-dba-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 5c65e63da595bcff533820f081728ba5715cb58428d3711dc18bf34a0efb8e54
php53-devel-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: de6c54f46553334b46ae3537fc615bd4558dd4a7bc29c4a700d239760d33bc87
php53-gd-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 28289c206a3d1f3b392ef971a9ebcc4d8f2da385e15d1c904eed757c8c01621f
php53-imap-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 730d04eb4de0698f0ce8e069e22114f1d8b5b6bdc289adb708e750e5de42acf2
php53-intl-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: f8d82e72886a4637d068dd1d899dc948789e92863f342a01c8ce25bbd91e3036
php53-ldap-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: e6941ec67b79e4df96fe585d464ed9a3abffc3aa0f3022857ff948380db26447
php53-mbstring-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 50d737f404ffb81e7709b79db2a0c2e943f13dac2f940d3b068f380caa903cf4
php53-mysql-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 7fe51c0c85235a2a38100500d90f7881620c00dd8ba1c3fc18bb358bc57cbc01
php53-odbc-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: c34b121cade4b384326e14a48e7c9b642345bb16f8dee3c184eecd0630f66258
php53-pdo-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: cdd50ae59c4d882f75313c00ab1ffc87730427bd1804aee602f3b523de931748
php53-pgsql-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 687b9c07e02417ee33d64cb48b427fd55584319d6518c194c66c02a27e663e64
php53-process-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 66b10dbd1b837c07830d56498555b9b32ddb6e23d960351475ae5c2815a39b43
php53-pspell-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: b6d2bb41cec9198bfd2bfcfce74ec16f30519b631c8d7a0429265a3f6614654a
php53-snmp-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 30bb1ef15871fb647a5d625ac7f8672ac2abae742d63f92cf6273b415f88bd6f
php53-soap-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 2598e0765b67e8e68323f6ef196a6843fc5a8fdd8c2643d0534bf444e0b081f3
php53-xml-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 074d2a75eb8d80dc283af57ba619a26adad242db043d096b054b0a65d92a75df
php53-xmlrpc-5.3.3-1.el5_6.4.x86_64.rpm	SHA-256: 78b6fd85d69812fb39a3ec02f1f72bbbb703ce3ffaeae45d27dd5acea53178f1