| Description: | Description:
The remote host is missing updates announced in
advisory SUSE-SA:2007:044.
The scripting language implementations PHP4 and PHP5 have been updated to
fix several security issues.
The updates have been released over the last weeks after they passed QA,
this summarizes this set of updates.
The following issues have been fixed:
- CVE-2007-3007: missing open_basedir and safe_mode restriction
in realpath
- CVE-2007-2872: chunk_split() integer overflow
- CVE-2007-2756: DoS condition in libgd's image processing
- CVE-2007-1396: possible super-global overwrite inside
import_request_variables()
- CVE-2007-2511: buffer overflow inside user_filter_factory_create()
- CVE-2007-1864: remotely trigger-able buffer overflow inside
bundled libxmlrpc
- CVE-2007-2509: CRLF injection inside ftp_putcmd()
- CVE-2007-2510: remotely trigger-able buffer overflow inside
make_http_soap_request()
- CVE-2007-0906 / MOPB-41-2007: PHP 5 sqlite_udf_decode_binary()
Buffer Overflow Vulnerability
- CVE-2007-1285 / MOPB-03-2007: fixed deep recursion DoS by limiting
the nesting level of input variables
Solution:
Update your system with the packages as indicated in
the referenced security advisory.
http://www.securityspace.com/smysecure/catid.html?in=SUSE-SA:2007:044
Risk factor : High
CVSS Score:
7.5
|
