news 28 Posted May 8, 2008 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] php (SSA:2008-128-01) New php packages are available for Slackware 10.2, 11.0, 12.0, 12.1, and -current to fix security issues. Note that PHP5 is not the default PHP for Slackware 10.2 or 11.0 (those use PHP4), so if your PHP code is not ready for PHP5, don't upgrade until it is or you'll (by definition) run into problems. More details about one of the issues may be found in the Common Vulnerabilities and Exposures (CVE) database: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0599 Here are the details from the Slackware 12.1 ChangeLog: +--------------------------+ patches/packages/php-5.2.6-i486-1_slack12.1.tgz: Upgraded to php-5.2.6. This version of PHP contains many fixes and enhancements. Some of the fixes are security related, and the PHP release announcement provides this list: * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin. * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz. * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh. * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz. * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser. * Upgraded bundled PCRE to version 7.6 When last checked, CVE-2008-0599 was not yet open. However, additional information should become available at this URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0599 The list reproduced above, as well as additional information about other fixes in PHP 5.2.6 may be found in the PHP release announcement here: http://www.php.net/releases/5_2_6.php (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ HINT: Getting slow download speeds from ftp.slackware.com? Give slackware.osuosl.org a try. This is another primary FTP site for Slackware that can be considerably faster than downloading directly from ftp.slackware.com. Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating additional FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you. Updated package for Slackware 10.2: ftp://ftp.slackware.com/pub/slackware/slackware-10.2/testing/packages/php5/php-5.2.6-i486-1_slack10.2.tgz Updated package for Slackware 11.0: ftp://ftp.slackware.com/pub/slackware/slackware-11.0/extra/php5/php-5.2.6-i486-1_slack11.0.tgz Updated package for Slackware 12.0: ftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/php-5.2.6-i486-1_slack12.0.tgz Updated package for Slackware 12.1: ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/php-5.2.6-i486-1_slack12.1.tgz Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/php-5.2.6-i486-1.tgz MD5 signatures: +-------------+ Slackware 10.2 package: 4efe7aac0d75ac62b7a81795d026c9b4 php-5.2.6-i486-1_slack10.2.tgz Slackware 11.0 package: f34eb2916cac7003750fc56b79d7974b php-5.2.6-i486-1_slack11.0.tgz Slackware 12.0 package: ffca00ec8ce0209e7d9c31c2d922e2fe php-5.2.6-i486-1_slack12.0.tgz Slackware 12.1 package: 9b0e03d4a306b64c7b61abd3d3de935d php-5.2.6-i486-1_slack12.1.tgz Slackware -current package: b0ccfaca2876c09ee8359a1b6a012406 php-5.2.6-i486-1.tgz Installation instructions: +------------------------+ First, stop Apache: # apachectl stop Next, upgrade to the new PHP package: # upgradepkg php-5.2.6-i486-1_slack12.1.tgz Finally, restart Apache: # apachectl start Or, for Apache 1.3.x versions using SSL: # apachectl startssl +-----+ Slackware Linux Security Team http://slackware.com/gpg-key security ( -at -) slackware.com +------------------------------------------------------------------------+ Share this post Link to post
