Test ID:	1.3.6.1.4.1.25623.1.0.58297
Category:	Gentoo Local Security Checks
Title:	Gentoo Security Advisory GLSA 200705-19 (php)
Summary:	The remote host is missing updates announced in;advisory GLSA 200705-19.
Description:	Summary: The remote host is missing updates announced in advisory GLSA 200705-19. Vulnerability Insight: PHP contains several vulnerabilities including buffer and integer overflows which could under certain conditions lead to the remote execution of arbitrary code. Solution: All PHP 5 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-lang/php-5.2.2' All PHP 4 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev-lang/php-4.4.7' CVSS Score: 7.8 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2007-1001 20070407 PHP <= 5.2.1 wbmp file handling integer overflow http://www.securityfocus.com/archive/1/464957/100/0/threaded 20070418 rPSA-2007-0073-1 php php-mysql php-pgsql http://www.securityfocus.com/archive/1/466166/100/0/threaded 23357 http://www.securityfocus.com/bid/23357 24814 http://secunia.com/advisories/24814 24909 http://secunia.com/advisories/24909 24924 http://secunia.com/advisories/24924 24945 http://secunia.com/advisories/24945 24965 http://secunia.com/advisories/24965 25056 http://secunia.com/advisories/25056 25151 http://secunia.com/advisories/25151 25159 http://www.securityfocus.com/bid/25159 25445 http://secunia.com/advisories/25445 26235 http://secunia.com/advisories/26235 ADV-2007-1269 http://www.vupen.com/english/advisories/2007/1269 ADV-2007-2732 http://www.vupen.com/english/advisories/2007/2732 APPLE-SA-2007-07-31 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html GLSA-200705-19 http://security.gentoo.org/glsa/glsa-200705-19.xml MDKSA-2007:087 http://www.mandriva.com/security/advisories?name=MDKSA-2007:087 MDKSA-2007:088 http://www.mandriva.com/security/advisories?name=MDKSA-2007:088 MDKSA-2007:089 http://www.mandriva.com/security/advisories?name=MDKSA-2007:089 MDKSA-2007:090 http://www.mandriva.com/security/advisories?name=MDKSA-2007:090 RHSA-2007:0153 http://www.redhat.com/support/errata/RHSA-2007-0153.html RHSA-2007:0155 http://rhn.redhat.com/errata/RHSA-2007-0155.html RHSA-2007:0162 http://www.redhat.com/support/errata/RHSA-2007-0162.html SSA:2007-127 http://www.slackware.org/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.470053 SUSE-SA:2007:032 http://www.novell.com/linux/security/advisories/2007_32_php.html http://cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/wbmp.c?r1=1.2.4.1&r2=1.2.4.1.8.1 http://cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/wbmp.c?revision=1.2.4.1.8.1&view=markup http://docs.info.apple.com/article.html?artnum=306172 http://ifsec.blogspot.com/2007/04/php-521-wbmp-file-handling-integer.html http://us2.php.net/releases/4_4_7.php http://us2.php.net/releases/5_2_2.php https://issues.rpath.com/browse/RPL-1268 oval:org.mitre.oval:def:10179 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10179 php-gd-overflow(33453) https://exchange.xforce.ibmcloud.com/vulnerabilities/33453 Common Vulnerability Exposure (CVE) ID: CVE-2007-1285 BugTraq ID: 22764 http://www.securityfocus.com/bid/22764 Bugtraq: 20070418 rPSA-2007-0073-1 php php-mysql php-pgsql (Google Search) http://www.php-security.org/MOPB/MOPB-03-2007.html http://www.osvdb.org/32769 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11017 http://www.redhat.com/support/errata/RHSA-2007-0082.html RedHat Security Advisories: RHSA-2007:0154 http://rhn.redhat.com/errata/RHSA-2007-0154.html RedHat Security Advisories: RHSA-2007:0155 RedHat Security Advisories: RHSA-2007:0163 http://rhn.redhat.com/errata/RHSA-2007-0163.html http://www.securitytracker.com/id?1017771 http://secunia.com/advisories/24910 http://secunia.com/advisories/24941 http://secunia.com/advisories/26048 http://secunia.com/advisories/26642 http://secunia.com/advisories/27864 http://secunia.com/advisories/28936 http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.335136 SuSE Security Announcement: SUSE-SA:2007:044 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html https://usn.ubuntu.com/549-1/ http://www.ubuntu.com/usn/usn-549-2 Common Vulnerability Exposure (CVE) ID: CVE-2007-1286 BugTraq ID: 22765 http://www.securityfocus.com/bid/22765 Debian Security Information: DSA-1282 (Google Search) http://www.debian.org/security/2007/dsa-1282 Debian Security Information: DSA-1283 (Google Search) http://www.debian.org/security/2007/dsa-1283 http://security.gentoo.org/glsa/glsa-200703-21.xml HPdes Security Advisory: HPSBMA02215 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506 HPdes Security Advisory: HPSBTU02232 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137 HPdes Security Advisory: SSRT071423 HPdes Security Advisory: SSRT071429 http://www.php-security.org/MOPB/MOPB-04-2007.html http://www.osvdb.org/32771 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11575 http://secunia.com/advisories/24419 http://secunia.com/advisories/24606 http://secunia.com/advisories/25025 http://secunia.com/advisories/25062 http://secunia.com/advisories/25423 http://secunia.com/advisories/25850 http://www.trustix.org/errata/2007/0009/ http://www.vupen.com/english/advisories/2007/1991 http://www.vupen.com/english/advisories/2007/2374 XForce ISS Database: php-zval-code-execution(32796) https://exchange.xforce.ibmcloud.com/vulnerabilities/32796 Common Vulnerability Exposure (CVE) ID: CVE-2007-1484 BugTraq ID: 22990 http://www.securityfocus.com/bid/22990 BugTraq ID: 25159 http://www.php-security.org/MOPB/MOPB-24-2007.html http://secunia.com/advisories/24542 http://secunia.com/advisories/25057 SuSE Security Announcement: SUSE-SA:2007:032 (Google Search) http://www.ubuntu.com/usn/usn-455-1 Common Vulnerability Exposure (CVE) ID: CVE-2007-1521 BugTraq ID: 22968 http://www.securityfocus.com/bid/22968 http://www.php-security.org/MOPB/MOPB-22-2007.html http://secunia.com/advisories/24505 http://www.vupen.com/english/advisories/2007/0960 Common Vulnerability Exposure (CVE) ID: CVE-2007-1583 BugTraq ID: 23016 http://www.securityfocus.com/bid/23016 http://www.php-security.org/MOPB/MOPB-26-2007.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10245 Common Vulnerability Exposure (CVE) ID: CVE-2007-1700 BugTraq ID: 23119 http://www.securityfocus.com/bid/23119 http://www.php-security.org/MOPB/MOPB-30-2007.html XForce ISS Database: php-session-extension-code-execution(33520) https://exchange.xforce.ibmcloud.com/vulnerabilities/33520 Common Vulnerability Exposure (CVE) ID: CVE-2007-1701 BugTraq ID: 23120 http://www.securityfocus.com/bid/23120 http://www.php-security.org/MOPB/MOPB-31-2007.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11034 XForce ISS Database: php-sessiondecode-code-execution(33658) https://exchange.xforce.ibmcloud.com/vulnerabilities/33658 Common Vulnerability Exposure (CVE) ID: CVE-2007-1711 BugTraq ID: 23121 http://www.securityfocus.com/bid/23121 http://www.php-security.org/MOPB/MOPB-32-2007.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10406 XForce ISS Database: php-deserializer-code-execution(33575) https://exchange.xforce.ibmcloud.com/vulnerabilities/33575 Common Vulnerability Exposure (CVE) ID: CVE-2007-1717 BugTraq ID: 23146 http://www.securityfocus.com/bid/23146 http://www.php-security.org/MOPB/MOPB-33-2007.html XForce ISS Database: php-emailmessages-manipulation(33518) https://exchange.xforce.ibmcloud.com/vulnerabilities/33518 Common Vulnerability Exposure (CVE) ID: CVE-2007-1718 BugTraq ID: 23145 http://www.securityfocus.com/bid/23145 http://www.php-security.org/MOPB/MOPB-34-2007.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10951 http://www.securitytracker.com/id?1017946 XForce ISS Database: php-mailfunction-header-injection(33516) https://exchange.xforce.ibmcloud.com/vulnerabilities/33516 Common Vulnerability Exposure (CVE) ID: CVE-2007-1864 1018024 http://www.securitytracker.com/id?1018024 2007-0017 http://www.trustix.org/errata/2007/0017/ 23813 http://www.securityfocus.com/bid/23813 25187 http://secunia.com/advisories/25187 25191 http://secunia.com/advisories/25191 25255 http://secunia.com/advisories/25255 25660 http://secunia.com/advisories/25660 25938 http://secunia.com/advisories/25938 25945 http://secunia.com/advisories/25945 26048 26102 http://secunia.com/advisories/26102 27377 http://secunia.com/advisories/27377 34674 http://osvdb.org/34674 ADV-2007-2187 http://www.vupen.com/english/advisories/2007/2187 DSA-1330 http://www.debian.org/security/2007/dsa-1330 DSA-1331 http://www.debian.org/security/2007/dsa-1331 MDKSA-2007:102 http://www.mandriva.com/security/advisories?name=MDKSA-2007:102 MDKSA-2007:103 http://www.mandriva.com/security/advisories?name=MDKSA-2007:103 RHSA-2007:0348 https://rhn.redhat.com/errata/RHSA-2007-0348.html RHSA-2007:0349 http://www.redhat.com/support/errata/RHSA-2007-0349.html RHSA-2007:0355 http://www.redhat.com/support/errata/RHSA-2007-0355.html SUSE-SA:2007:044 USN-485-1 http://www.ubuntu.com/usn/usn-485-1 http://support.avaya.com/elmodocs2/security/ASA-2007-231.htm https://issues.rpath.com/browse/RPL-1693 oval:org.mitre.oval:def:11257 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11257 Common Vulnerability Exposure (CVE) ID: CVE-2007-1900 BugTraq ID: 23359 http://www.securityfocus.com/bid/23359 https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00397.html http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml HPdes Security Advisory: HPSBUX02262 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795 HPdes Security Advisory: SSRT071447 http://www.php-security.org/MOPB/PMOPB-45-2007.html http://www.osvdb.org/33962 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6067 http://secunia.com/advisories/24824 http://secunia.com/advisories/25535 http://secunia.com/advisories/26231 http://secunia.com/advisories/27037 http://secunia.com/advisories/27102 http://secunia.com/advisories/27110 http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.482863 http://www.trustix.org/errata/2007/0023/ http://www.vupen.com/english/advisories/2007/2016 http://www.vupen.com/english/advisories/2007/3386 XForce ISS Database: php-filtervalidateemail-header-injection(33510) https://exchange.xforce.ibmcloud.com/vulnerabilities/33510 Common Vulnerability Exposure (CVE) ID: CVE-2007-2509 BugTraq ID: 23813 BugTraq ID: 23818 http://www.securityfocus.com/bid/23818 Bugtraq: 20070323 CRLF injection in PHP ftp function (Google Search) http://www.securityfocus.com/archive/1/463596/100/0/threaded Debian Security Information: DSA-1295 (Google Search) http://www.debian.org/security/2007/dsa-1295 Debian Security Information: DSA-1296 (Google Search) http://www.debian.org/security/2007/dsa-1296 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10839 RedHat Security Advisories: RHSA-2007:0348 http://www.redhat.com/support/errata/RHSA-2007-0888.html RedHat Security Advisories: RHSA-2007:0889 http://rhn.redhat.com/errata/RHSA-2007-0889.html http://www.securitytracker.com/id?1018022 http://secunia.com/advisories/25318 http://secunia.com/advisories/25365 http://secunia.com/advisories/25372 http://secunia.com/advisories/26967 http://secunia.com/advisories/27351 http://securityreason.com/securityalert/2672 http://www.ubuntu.com/usn/usn-462-1 XForce ISS Database: php-ftpputcmd-crlf-injection(34413) https://exchange.xforce.ibmcloud.com/vulnerabilities/34413 Common Vulnerability Exposure (CVE) ID: CVE-2007-2510 BugTraq ID: 24034 http://www.securityfocus.com/bid/24034 http://osvdb.org/34675 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10715 http://www.securitytracker.com/id?1018023 Common Vulnerability Exposure (CVE) ID: CVE-2007-2511 http://osvdb.org/34676
Copyright	Copyright (C) 2008 E-Soft Inc.

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.