Test ID:	1.3.6.1.4.1.25623.1.0.61503
Category:	Ubuntu Local Security Checks
Title:	Ubuntu USN-628-1 (php5)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to php5 announced via advisory USN-628-1. A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 LTS This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. For details, please visit the referenced security advisories. Solution: The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: libapache2-mod-php5 5.1.2-1ubuntu3.12 php5-cgi 5.1.2-1ubuntu3.12 php5-cli 5.1.2-1ubuntu3.12 php5-curl 5.1.2-1ubuntu3.12 Ubuntu 7.04: libapache2-mod-php5 5.2.1-0ubuntu1.6 php5-cgi 5.2.1-0ubuntu1.6 php5-cli 5.2.1-0ubuntu1.6 php5-curl 5.2.1-0ubuntu1.6 Ubuntu 7.10: libapache2-mod-php5 5.2.3-1ubuntu6.4 php5-cgi 5.2.3-1ubuntu6.4 php5-cli 5.2.3-1ubuntu6.4 php5-curl 5.2.3-1ubuntu6.4 Ubuntu 8.04 LTS: libapache2-mod-php5 5.2.4-2ubuntu5.3 php5-cgi 5.2.4-2ubuntu5.3 php5-cli 5.2.4-2ubuntu5.3 php5-curl 5.2.4-2ubuntu5.3 In general, a standard system upgrade is sufficient to effect the necessary changes. http://www.securityspace.com/smysecure/catid.html?in=USN-628-1 Risk factor : Critical CVSS Score: 10.0
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2007-4782 Bugtraq: 20070904 PHP < 5.2.3 fnmatch() denial of service (Google Search) http://www.securityfocus.com/archive/1/478630/100/0/threaded Bugtraq: 20070905 PHP < 5.2.3 glob() denial of service (Google Search) http://www.securityfocus.com/archive/1/478626/100/0/threaded http://www.securityfocus.com/archive/1/478726/100/0/threaded https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00773.html http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml http://www.mandriva.com/security/advisories?name=MDVSA-2009:022 http://www.mandriva.com/security/advisories?name=MDVSA-2009:023 http://osvdb.org/38686 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10897 http://www.redhat.com/support/errata/RHSA-2008-0505.html http://www.redhat.com/support/errata/RHSA-2008-0544.html http://www.redhat.com/support/errata/RHSA-2008-0545.html http://www.redhat.com/support/errata/RHSA-2008-0582.html http://secunia.com/advisories/27102 http://secunia.com/advisories/28658 http://secunia.com/advisories/30828 http://secunia.com/advisories/31119 http://secunia.com/advisories/31200 http://securityreason.com/securityalert/3109 SuSE Security Announcement: SUSE-SA:2008:004 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html http://www.ubuntu.com/usn/usn-628-1 XForce ISS Database: php-fnmatch-dos(36457) https://exchange.xforce.ibmcloud.com/vulnerabilities/36457 XForce ISS Database: php-globfunction-dos(36461) https://exchange.xforce.ibmcloud.com/vulnerabilities/36461 Common Vulnerability Exposure (CVE) ID: CVE-2007-4850 http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html BugTraq ID: 27413 http://www.securityfocus.com/bid/27413 BugTraq ID: 29009 http://www.securityfocus.com/bid/29009 BugTraq ID: 31681 http://www.securityfocus.com/bid/31681 Bugtraq: 20080122 PHP 5.2.5 cURL safe_mode bypass (Google Search) http://www.securityfocus.com/archive/1/486856/100/0/threaded Bugtraq: 20080527 rPSA-2008-0178-1 php php-mysql php-pgsql (Google Search) http://www.securityfocus.com/archive/1/492671/100/0/threaded http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059849.html http://www.openwall.com/lists/oss-security/2008/05/02/2 http://secunia.com/advisories/30048 http://secunia.com/advisories/30411 http://secunia.com/advisories/31326 http://secunia.com/advisories/32222 http://securityreason.com/securityalert/3562 http://securityreason.com/achievement_securityalert/51 http://www.vupen.com/english/advisories/2008/1412 http://www.vupen.com/english/advisories/2008/2268 http://www.vupen.com/english/advisories/2008/2780 XForce ISS Database: php-curlinit-security-bypass(39852) https://exchange.xforce.ibmcloud.com/vulnerabilities/39852 XForce ISS Database: php-safemode-directive-security-bypass(42134) https://exchange.xforce.ibmcloud.com/vulnerabilities/42134 Common Vulnerability Exposure (CVE) ID: CVE-2007-5898 Debian Security Information: DSA-1444 (Google Search) http://www.debian.org/security/2008/dsa-1444 HPdes Security Advisory: HPSBUX02332 http://www.securityfocus.com/archive/1/491693/100/0/threaded HPdes Security Advisory: SSRT080056 http://www.mandriva.com/security/advisories?name=MDVSA-2008:125 http://www.mandriva.com/security/advisories?name=MDVSA-2008:126 http://www.mandriva.com/security/advisories?name=MDVSA-2008:127 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10080 http://www.redhat.com/support/errata/RHSA-2008-0546.html http://securitytracker.com/id?1018934 http://secunia.com/advisories/27648 http://secunia.com/advisories/27659 http://secunia.com/advisories/27864 http://secunia.com/advisories/28249 http://secunia.com/advisories/30040 http://secunia.com/advisories/31124 https://usn.ubuntu.com/549-1/ http://www.ubuntu.com/usn/usn-549-2 Common Vulnerability Exposure (CVE) ID: CVE-2007-5899 http://osvdb.org/38918 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11211 Common Vulnerability Exposure (CVE) ID: CVE-2008-0599 Bugtraq: 20080523 rPSA-2008-0176-1 php php-cgi php-imap php-mcrypt php-mysql php-mysqli php-pgsql php-soap php-xsl php5 php5-cgi php5-imap php5-mcrypt php5-mysql php5-mysqli php5-pear php5-pgsql php5-soap php5-xsl (Google Search) http://www.securityfocus.com/archive/1/492535/100/0/threaded CERT/CC vulnerability note: VU#147027 http://www.kb.cert.org/vuls/id/147027 https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00779.html http://security.gentoo.org/glsa/glsa-200811-05.xml HPdes Security Advisory: HPSBUX02342 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01476437 HPdes Security Advisory: HPSBUX02431 http://marc.info/?l=bugtraq&m=124654546101607&w=2 HPdes Security Advisory: HPSBUX02465 http://marc.info/?l=bugtraq&m=125631037611762&w=2 HPdes Security Advisory: SSRT080063 HPdes Security Advisory: SSRT090085 HPdes Security Advisory: SSRT090192 http://www.mandriva.com/security/advisories?name=MDVSA-2008:128 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5510 http://www.securitytracker.com/id?1019958 http://secunia.com/advisories/30083 http://secunia.com/advisories/30345 http://secunia.com/advisories/30616 http://secunia.com/advisories/30757 http://secunia.com/advisories/32746 http://secunia.com/advisories/35650 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.488951 http://www.vupen.com/english/advisories/2008/1810/references XForce ISS Database: php-vector-unspecified(42137) https://exchange.xforce.ibmcloud.com/vulnerabilities/42137 Common Vulnerability Exposure (CVE) ID: CVE-2008-1384 BugTraq ID: 28392 http://www.securityfocus.com/bid/28392 Bugtraq: 20080321 {securityreason.com}PHP 5 *printf() - Integer Overflow (Google Search) http://www.securityfocus.com/archive/1/489962/100/0/threaded Debian Security Information: DSA-1572 (Google Search) http://www.debian.org/security/2008/dsa-1572 http://secunia.com/advisories/30158 http://secunia.com/advisories/30967 http://securityreason.com/achievement_securityalert/52 SuSE Security Announcement: SUSE-SR:2008:014 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html XForce ISS Database: php-phpsprintfappendstring-overflow(41386) https://exchange.xforce.ibmcloud.com/vulnerabilities/41386 Common Vulnerability Exposure (CVE) ID: CVE-2008-2050 20080523 rPSA-2008-0176-1 php php-cgi php-imap php-mcrypt php-mysql php-mysqli php-pgsql php-soap php-xsl php5 php5-cgi php5-imap php5-mcrypt php5-mysql php5-mysqli php5-pear php5-pgsql php5-soap php5-xsl 29009 30048 30083 30158 30345 30967 31200 31326 32746 ADV-2008-1412 ADV-2008-2268 APPLE-SA-2008-07-31 DSA-1572 GLSA-200811-05 MDVSA-2009:022 MDVSA-2009:023 SSA:2008-128-01 SUSE-SR:2008:014 USN-628-1 [oss-security] 20080502 CVE Request (PHP) http://cvs.php.net/viewvc.cgi/php-src/sapi/cgi/fastcgi.c?r1=1.44&r2=1.45&diff_format=u http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0176 http://www.php.net/ChangeLog-5.php https://issues.rpath.com/browse/RPL-2503 php-fastcgisapi-bo(42133) https://exchange.xforce.ibmcloud.com/vulnerabilities/42133 Common Vulnerability Exposure (CVE) ID: CVE-2008-2051 Debian Security Information: DSA-1578 (Google Search) http://www.debian.org/security/2008/dsa-1578 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10256 http://secunia.com/advisories/30288 Common Vulnerability Exposure (CVE) ID: CVE-2008-2107 Bugtraq: 20080506 Advisory SE-2008-02: PHP GENERATE_SEED() Weak Random Number Seed Vulnerability (Google Search) http://www.securityfocus.com/archive/1/491683/100/0/threaded Debian Security Information: DSA-1789 (Google Search) http://www.debian.org/security/2009/dsa-1789 http://archives.neohapsis.com/archives/fulldisclosure/2008-05/0103.html http://www.mandriva.com/security/advisories?name=MDVSA-2008:129 http://www.mandriva.com/security/advisories?name=MDVSA-2008:130 http://www.sektioneins.de/advisories/SE-2008-02.txt https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10644 http://secunia.com/advisories/35003 http://securityreason.com/securityalert/3859 XForce ISS Database: php-generateseed-security-bypass(42284) https://exchange.xforce.ibmcloud.com/vulnerabilities/42284 XForce ISS Database: php-generateseed-weak-security(42226) https://exchange.xforce.ibmcloud.com/vulnerabilities/42226 Common Vulnerability Exposure (CVE) ID: CVE-2008-2108 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10844 Common Vulnerability Exposure (CVE) ID: CVE-2008-2371 20081027 rPSA-2008-0305-1 pcre http://www.securityfocus.com/archive/1/497828/100/0/threaded 30087 http://www.securityfocus.com/bid/30087 30916 http://secunia.com/advisories/30916 30944 http://secunia.com/advisories/30944 30945 http://secunia.com/advisories/30945 30958 http://secunia.com/advisories/30958 30961 http://secunia.com/advisories/30961 30972 http://secunia.com/advisories/30972 30990 http://secunia.com/advisories/30990 31681 32222 32454 http://secunia.com/advisories/32454 35074 http://secunia.com/advisories/35074 35650 39300 http://secunia.com/advisories/39300 ADV-2008-2005 http://www.vupen.com/english/advisories/2008/2005 ADV-2008-2006 http://www.vupen.com/english/advisories/2008/2006 ADV-2008-2336 http://www.vupen.com/english/advisories/2008/2336 ADV-2008-2780 ADV-2009-1297 http://www.vupen.com/english/advisories/2009/1297 ADV-2010-0833 http://www.vupen.com/english/advisories/2010/0833 APPLE-SA-2008-10-09 APPLE-SA-2009-05-12 http://lists.apple.com/archives/security-announce/2009/May/msg00002.html DSA-1602 http://www.debian.org/security/2008/dsa-1602 FEDORA-2008-6025 https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00105.html FEDORA-2008-6048 https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00123.html GLSA-200807-03 http://www.gentoo.org/security/en/glsa/glsa-200807-03.xml HPSBUX02431 HPSBUX02465 MDVSA-2008:147 http://www.mandriva.com/security/advisories?name=MDVSA-2008:147 SSRT090085 SSRT090192 TA09-133A http://www.us-cert.gov/cas/techalerts/TA09-133A.html USN-624-1 http://www.ubuntu.com/usn/usn-624-1 USN-624-2 http://ubuntu.com/usn/usn-624-2 http://bugs.gentoo.org/show_bug.cgi?id=228091 http://ftp.gnome.org/pub/GNOME/sources/glib/2.16/glib-2.16.4.changes http://support.apple.com/kb/HT3216 http://support.apple.com/kb/HT3549 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0305 Common Vulnerability Exposure (CVE) ID: CVE-2008-2829 BugTraq ID: 29829 http://www.securityfocus.com/bid/29829 Bugtraq: 20090302 rPSA-2009-0035-1 php php-cgi php-imap php-mcrypt php-mysql php-mysqli php-pgsql php-soap php-xsl php5 php5-cgi php5-imap php5-mcrypt php5-mysql php5-mysqli php5-pear php5-pgsql php5-soap php5-xsl (Google Search) http://www.securityfocus.com/archive/1/501376/100/0/threaded Cert/CC Advisory: TA09-133A https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01451.html https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01465.html http://bugs.php.net/bug.php?id=42862 http://www.openwall.com/lists/oss-security/2008/06/19/6 http://www.openwall.com/lists/oss-security/2008/06/24/2 http://osvdb.org/46641 http://secunia.com/advisories/35306 SuSE Security Announcement: SUSE-SR:2008:027 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html XForce ISS Database: php-phpimap-dos(43357) https://exchange.xforce.ibmcloud.com/vulnerabilities/43357
Copyright	Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.