php5 5.3.3-1ubuntu9.4 source package in Ubuntu

Changelog

php5 (5.3.3-1ubuntu9.4) maverick-security; urgency=low

  * SECURITY UPDATE: arbitrary files removal via cronjob
    - debian/php5-common.php5.cron.d: take greater care when removing
      session files.
    - http://git.debian.org/?p=pkg-php%2Fphp.git;a=commitdiff_plain;h=d09fd04ed7bfcf7f008360c6a42025108925df09
    - CVE-2011-0441
  * SECURITY UPDATE: symlink tmp races in pear install
    - debian/patches/php5-pear-CVE-2011-1072.patch: improved
      tempfile handling.
    - debian/rules: apply patch manually after unpacking PEAR phar
      archive.
    - CVE-2011-1072
  * SECURITY UPDATE: more symlink races in pear install
    - debian/patches/php5-pear-CVE-2011-1144.patch: add TOCTOU save
      file handler.
    - debian/rules: apply patch manually after unpacking PEAR phar
      archive.
    - CVE-2011-1144
  * SECURITY UPDATE: pathname restriction bypass vulnerability
    - debian/patches/php5-CVE-2006-7243.patch: check for passed
      filenames containing NULL bytes.
    - CVE-2006-7243
  * SECURITY UPDATE: use-after-free vulnerability
    - debian/patches/php5-CVE-2010-4697.patch: retain reference to
      object until getter/setter are done.
    - CVE-2010-4697
  * SECURITY UPDATE: denial of service through application crash with
    invalid images
    - debian/patches/php5-CVE-2010-4698.patch: verify anti-aliasing
      steps are either 4 or 16.
    - CVE-2010-4698
  * SECURITY UPDATE: denial of service through application crash
    - debian/patches/php5-CVE-2011-0420.patch: improve grapheme_extract()
      argument validation.
    - CVE-2011-0420
  * SECURITY UPDATE: denial of service through application crash
    - debian/patches/php5-CVE-2011-0421.patch: fail operation gracefully
      when handling zero sized zipfile with the FL_UNCHANGED argument
    - CVE-2011-0421
  * SECURITY UPDATE: denial of service through application crash when
    handling images with invalid exif tags
    - debian/patches/php5-CVE-2011-0708.patch: stricter exif checking
    - CVE-2011-0708
  * SECURITY UPDATE: denial of service and possible data disclosure
    through integer overflow
    - debian/patches/php5-CVE-2011-1092.patch: better boundary
      condition checks in shmop_read()
    - CVE-2011-1092
  * SECURITY UPDATE: use-after-free vulnerability
    - debian/patches/php5-CVE-2011-1148.patch: improve reference
      counting
    - CVE-2011-1148
  * SECURITY UPDATE: format string vulnerability
    - debian/patches/php5-CVE-2011-1153.patch: correctly quote format
      strings
    - CVE-2011-1153
  * SECURITY UPDATE: denial of service through buffer overflow crash
    (code execution mitigated by compilation with Fortify Source)
    - debian/patches/php5-CVE-2011-1464.patch: limit amount of precision
      to ensure fitting within MAX_BUF_SIZE
    - CVE-2011-1464
  * SECURITY UPDATE: denial of service through application crash via
    integer overflow.
    - debian/patches/php5-CVE-2011-1466.patch: improve boundary
      condition checking in SdnToJulian()
    - CVE-2011-1466
  * SECURITY UPDATE: denial of service through application crash
    - debian/patches/php5-CVE-2011-1467.patch: check for invalid
      attribute symbols in NumberFormatter::setSymbol()
    - CVE-2011-1467
  * SECURITY UPDATE: denial of service through memory leak
    - debian/patches/php5-CVE-2011-1468.patch: fix memory leak of
      openssl contexts
    - CVE-2011-1468
  * SECURITY UPDATE: denial of service through application crash
    when using HTTP proxy with the FTP wrapper
    - debian/patches/php5-CVE-2011-1469.patch: improve pointer handling
    - CVE-2011-1469
  * SECURITY UPDATE: denial of service through application crash when
    handling ziparchive streams
    - debian/patches/php5-CVE-2011-1470.patch: set necessary elements of
      the meta data structure
    - CVE-2011-1470
  * SECURITY UPDATE: denial of service through application crash when
    handling malformed zip files
    - debian/patches/php5-CVE-2011-1471.patch: correct integer
      signedness error when handling zip_fread() return value.
    - CVE-2011-1471
  * debian/control: replace build-depends on mysql-server with
    mysql-server-core-5.1 and mysql-client-5.1 to avoid upstart and
    mysql-server-5.1 postinst confusion with starting up multiple
    mysqlds listening on the same port.
 -- Steve Beattie <email address hidden>   Tue, 26 Apr 2011 15:39:41 -0700

Upload details

Uploaded by:
Steve Beattie on 2011-04-27
Uploaded to:
Maverick
Original maintainer:
Ubuntu Developers
Architectures:
any
Section:
php
Urgency:
Low Urgency

See full publishing history Publishing

Series Pocket Published Component Section

Downloads

File Size SHA-256 Checksum
php5_5.3.3.orig.tar.gz 13.3 MiB a8bf9ce535fa4c3f7acd00ed92ca50be49e9710876649ef26369b0326985833c
php5_5.3.3-1ubuntu9.4.diff.gz 224.0 KiB 6d20b75be3a4979efb2f0dba846b9115fc3b16c69f8024cffaac2a8a4fd23e39
php5_5.3.3-1ubuntu9.4.dsc 3.2 KiB ab56fdb6bd3a9c1595dea88bc61edc799061cc9f1496849ce77f85988d17a2a6

View changes file

Binary packages built by this source

libapache2-mod-php5: No summary available for libapache2-mod-php5 in ubuntu maverick.

No description available for libapache2-mod-php5 in ubuntu maverick.

libapache2-mod-php5filter: No summary available for libapache2-mod-php5filter in ubuntu maverick.

No description available for libapache2-mod-php5filter in ubuntu maverick.

php-pear: No summary available for php-pear in ubuntu maverick.

No description available for php-pear in ubuntu maverick.

php5: No summary available for php5 in ubuntu maverick.

No description available for php5 in ubuntu maverick.

php5-cgi: No summary available for php5-cgi in ubuntu maverick.

No description available for php5-cgi in ubuntu maverick.

php5-cli: No summary available for php5-cli in ubuntu maverick.

No description available for php5-cli in ubuntu maverick.

php5-common: No summary available for php5-common in ubuntu maverick.

No description available for php5-common in ubuntu maverick.

php5-curl: No summary available for php5-curl in ubuntu maverick.

No description available for php5-curl in ubuntu maverick.

php5-dbg: No summary available for php5-dbg in ubuntu maverick.

No description available for php5-dbg in ubuntu maverick.

php5-dev: No summary available for php5-dev in ubuntu maverick.

No description available for php5-dev in ubuntu maverick.

php5-enchant: No summary available for php5-enchant in ubuntu maverick.

No description available for php5-enchant in ubuntu maverick.

php5-fpm: No summary available for php5-fpm in ubuntu maverick.

No description available for php5-fpm in ubuntu maverick.

php5-gd: No summary available for php5-gd in ubuntu maverick.

No description available for php5-gd in ubuntu maverick.

php5-gmp: No summary available for php5-gmp in ubuntu maverick.

No description available for php5-gmp in ubuntu maverick.

php5-intl: No summary available for php5-intl in ubuntu maverick.

No description available for php5-intl in ubuntu maverick.

php5-ldap: No summary available for php5-ldap in ubuntu maverick.

No description available for php5-ldap in ubuntu maverick.

php5-mysql: No summary available for php5-mysql in ubuntu maverick.

No description available for php5-mysql in ubuntu maverick.

php5-odbc: No summary available for php5-odbc in ubuntu maverick.

No description available for php5-odbc in ubuntu maverick.

php5-pgsql: No summary available for php5-pgsql in ubuntu maverick.

No description available for php5-pgsql in ubuntu maverick.

php5-pspell: No summary available for php5-pspell in ubuntu maverick.

No description available for php5-pspell in ubuntu maverick.

php5-recode: No summary available for php5-recode in ubuntu maverick.

No description available for php5-recode in ubuntu maverick.

php5-snmp: No summary available for php5-snmp in ubuntu maverick.

No description available for php5-snmp in ubuntu maverick.

php5-sqlite: No summary available for php5-sqlite in ubuntu maverick.

No description available for php5-sqlite in ubuntu maverick.

php5-sybase: No summary available for php5-sybase in ubuntu maverick.

No description available for php5-sybase in ubuntu maverick.

php5-tidy: No summary available for php5-tidy in ubuntu maverick.

No description available for php5-tidy in ubuntu maverick.

php5-xmlrpc: No summary available for php5-xmlrpc in ubuntu maverick.

No description available for php5-xmlrpc in ubuntu maverick.

php5-xsl: No summary available for php5-xsl in ubuntu maverick.

No description available for php5-xsl in ubuntu maverick.