| Description: | Description:
The remote host is missing an update to php
announced via advisory FEDORA-2007-526.
PHP is an HTML-embedded scripting language. PHP attempts to make it
easy for developers to write dynamically generated webpages. PHP also
offers built-in database integration for several commercial and
non-commercial database management systems, so writing a
database-enabled webpage with PHP is fairly simple. The most common
use of PHP coding is probably as a replacement for CGI scripts. The
mod_php module enables the Apache Web server to understand and process
the embedded PHP language in Web pages.
Update Information:
This update fixes a number of security issues in PHP.
A heap buffer overflow flaw was found in the PHP 'xmlrpc'
extension. A PHP script which implements an XML-RPC server
using this extension could allow a remote attacker to
execute arbitrary code as the 'apache' user. Note that this
flaw does not affect PHP applications using the pure-PHP
XML_RPC class provided in /usr/share/pear. (CVE-2007-1864)
A flaw was found in the PHP 'ftp' extension. If a PHP script
used this extension to provide access to a private FTP
server, and passed untrusted script input directly to any
function provided by this extension, a remote attacker would
be able to send arbitrary FTP commands to the server.
(CVE-2007-2509)
A buffer overflow flaw was found in the PHP 'soap'
extension, regarding the handling of an HTTP redirect
response when using the SOAP client provided by this
extension with an untrusted SOAP server. No mechanism to
trigger this flaw remotely is known. (CVE-2007-2510)
* Wed May 9 2007 Joe Orton 5.1.6-1.6
- add security fixes for CVE-2007-1864, CVE-2007-2509, CVE-2007-2510 (#235016)
* Thu Apr 5 2007 Joe Orton 5.1.6-1.5
- add security fixes for CVE-2007-0455, CVE-2007-1001,
CVE-2007-1285, CVE-2007-1583, CVE-2007-1718 (#235364)
* Fri Feb 23 2007 Joe Orton 5.1.6-1.4
- fix pdo-abi provide
* Tue Feb 20 2007 Joe Orton 5.1.6-1.3
- add security fixes for: CVE-2007-0906, CVE-2007-0907,
CVE-2007-0908, CVE-2007-0909, CVE-2007-0910, CVE-2007-0988 (#228011)
* Fri Nov 3 2006 Joe Orton 5.1.6-1.2
- add security fix for CVE-2006-5465 (#213732)
* Fri Oct 6 2006 Joe Orton 5.1.6-1.1
- update to 5.1.6 (#201767, #204995)
- add fix for upstream #38801
- add security fix for CVE-2006-4812
- drop Obsoletes for mod_php (#194590)
- add php-pdo-abi versioning (#193202)
- move php{-config,ize} man pages to -devel (#199382)
Solution: Apply the appropriate updates.
This update can be downloaded from:
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/5/
This update can be installed with the 'yum' update program. Use 'yum update
package-name' at the command line. For more information, refer to 'Managing
Software with yum,' available at http://fedora.redhat.com/docs/yum/.
http://www.securityspace.com/smysecure/catid.html?in=FEDORA-2007-526
Risk factor : Critical
CVSS Score:
10.0
|
