Test ID:	1.3.6.1.4.1.25623.1.0.61457
Category:	Slackware Local Security Checks
Title:	Slackware: Security Advisory (SSA:2008-128-01)
Summary:	The remote host is missing an update for the 'php' package(s) announced via the SSA:2008-128-01 advisory.
Description:	Summary: The remote host is missing an update for the 'php' package(s) announced via the SSA:2008-128-01 advisory. Vulnerability Insight: New php packages are available for Slackware 10.2, 11.0, 12.0, 12.1, and -current to fix security issues. Note that PHP5 is not the default PHP for Slackware 10.2 or 11.0 (those use PHP4), so if your PHP code is not ready for PHP5, don't upgrade until it is or you'll (by definition) run into problems. More details about one of the issues may be found in the Common Vulnerabilities and Exposures (CVE) database: [link moved to references] Here are the details from the Slackware 12.1 ChangeLog: +--------------------------+ patches/packages/php-5.2.6-i486-1_slack12.1.tgz: Upgraded to php-5.2.6. This version of PHP contains many fixes and enhancements. Some of the fixes are security related, and the PHP release announcement provides this list: * Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin. * Fixed integer overflow in printf() identified by Maksymilian Aciemowicz. * Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh. * Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz. * Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser. * Upgraded bundled PCRE to version 7.6 When last checked, CVE-2008-0599 was not yet open. However, additional information should become available at this URL: [link moved to references] The list reproduced above, as well as additional information about other fixes in PHP 5.2.6 may be found in the PHP release announcement here: [link moved to references] (* Security fix *) +--------------------------+ Affected Software/OS: 'php' package(s) on Slackware 10.2, Slackware 11.0, Slackware 12.0, Slackware 12.1, Slackware current. Solution: Please install the updated package(s). CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2008-0599 http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html BugTraq ID: 29009 http://www.securityfocus.com/bid/29009 Bugtraq: 20080523 rPSA-2008-0176-1 php php-cgi php-imap php-mcrypt php-mysql php-mysqli php-pgsql php-soap php-xsl php5 php5-cgi php5-imap php5-mcrypt php5-mysql php5-mysqli php5-pear php5-pgsql php5-soap php5-xsl (Google Search) http://www.securityfocus.com/archive/1/492535/100/0/threaded CERT/CC vulnerability note: VU#147027 http://www.kb.cert.org/vuls/id/147027 https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00779.html https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00773.html http://security.gentoo.org/glsa/glsa-200811-05.xml HPdes Security Advisory: HPSBUX02342 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01476437 HPdes Security Advisory: HPSBUX02431 http://marc.info/?l=bugtraq&m=124654546101607&w=2 HPdes Security Advisory: HPSBUX02465 http://marc.info/?l=bugtraq&m=125631037611762&w=2 HPdes Security Advisory: SSRT080063 HPdes Security Advisory: SSRT090085 HPdes Security Advisory: SSRT090192 http://www.mandriva.com/security/advisories?name=MDVSA-2008:127 http://www.mandriva.com/security/advisories?name=MDVSA-2008:128 http://www.openwall.com/lists/oss-security/2008/05/02/2 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5510 http://www.redhat.com/support/errata/RHSA-2008-0505.html http://www.securitytracker.com/id?1019958 http://secunia.com/advisories/30048 http://secunia.com/advisories/30083 http://secunia.com/advisories/30345 http://secunia.com/advisories/30616 http://secunia.com/advisories/30757 http://secunia.com/advisories/30828 http://secunia.com/advisories/31200 http://secunia.com/advisories/31326 http://secunia.com/advisories/32746 http://secunia.com/advisories/35650 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.488951 http://www.ubuntu.com/usn/usn-628-1 http://www.vupen.com/english/advisories/2008/1412 http://www.vupen.com/english/advisories/2008/1810/references http://www.vupen.com/english/advisories/2008/2268 XForce ISS Database: php-vector-unspecified(42137) https://exchange.xforce.ibmcloud.com/vulnerabilities/42137
Copyright	Copyright (C) 2012 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.