| Description: | Summary:
The remote host is missing an update for the 'php' package(s) announced via the SSA:2008-339-01 advisory.
Vulnerability Insight:
New php packages are available for Slackware 12.0, 12.1, and -current to
fix security issues, as well as make improvements and fix bugs.
Here are the details from the Slackware 12.1 ChangeLog:
+--------------------------+
patches/packages/php-5.2.7-i486-1_slack12.1.tgz: Upgraded to php-5.2.7.
In addition to improvements and bug fixes, this new version of PHP also
addresses several security issues, including:
Fixed a crash inside gd with invalid fonts (Fixes CVE-2008-3658).
Fixed a possible overflow inside memnstr (Fixes CVE-2008-3659).
Fixed security issues detailed in CVE-2008-2665 and CVE-2008-2666.
Crash with URI/file..php (filename contains 2 dots). (Fixes CVE-2008-3660).
rfc822.c legacy routine buffer overflow. (Fixes CVE-2008-2829).
Fixed extraction of zip files or directories when the entry name is a
relative path: [link moved to references]
These are the URLs to get more information:
[links moved to references]
(* Security fix *)
+--------------------------+
Affected Software/OS:
'php' package(s) on Slackware 12.0, Slackware 12.1, Slackware current.
Solution:
Please install the updated package(s).
CVSS Score:
7.5
CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
