php4 4:4.3.8-3ubuntu7.15 source package in Ubuntu

Changelog

php4 (4:4.3.8-3ubuntu7.15) warty-security; urgency=low

  * SECURITY UPDATE: multiple fixes backported from 5.1.2 and CVS:
    - Fix multiple HTTP response splitting vulnerabilities in sessions and
      the header() function, due to lack of input validation; CVE-2006-0207
      + Add safety checks in the header() function to make sure that we
        don't get newlines injected by (mis)use of user input in headers.
      + Add a check for invalid characters in session names, so that we
        aren't subject to HTTP response splitting vulnerabilities in
        the Set-Cookie header we send back out as a result of user input.
      + Bring in a patch from newer versions of php4 and php5, preventing
        us from sending session cookies when we were just handed one,
        unless the session ID has changed, eliminating another vector.
    - Filter HTML error reporting, preventing cross-site scripting attacks
      when both display_errors and html_errors are enabled; CVE-2006-0208

 -- Adam Conrad <email address hidden>   Wed,  8 Mar 2006 18:17:46 +1100