Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.63755
Category:Red Hat Local Security Checks
Title:RedHat Security Advisory RHSA-2009:0337
Summary:NOSUMMARY
Description:Description:
The remote host is missing updates announced in
advisory RHSA-2009:0337.

PHP is an HTML-embedded scripting language commonly used with the Apache
HTTP Web server.

A heap-based buffer overflow flaw was found in PHP's mbstring extension. A
remote attacker able to pass arbitrary input to a PHP script using mbstring
conversion functions could cause the PHP interpreter to crash or,
possibly, execute arbitrary code. (CVE-2008-5557)

A flaw was found in the handling of the mbstring.func_overload
configuration setting. A value set for one virtual host, or in a user's
.htaccess file, was incorrectly applied to other virtual hosts on the same
server, causing the handling of multibyte character strings to not work
correctly. (CVE-2009-0754)

A buffer overflow flaw was found in PHP's imageloadfont function. If a PHP
script allowed a remote attacker to load a carefully crafted font file, it
could cause the PHP interpreter to crash or, possibly, execute arbitrary
code. (CVE-2008-3658)

A flaw was found in the way PHP handled certain file extensions when
running in FastCGI mode. If the PHP interpreter was being executed via
FastCGI, a remote attacker could create a request which would cause the PHP
interpreter to crash. (CVE-2008-3660)

A memory disclosure flaw was found in the PHP gd extension's imagerotate
function. A remote attacker able to pass arbitrary values as the
background color argument of the function could, possibly, view portions
of the PHP interpreter's memory. (CVE-2008-5498)

All php users are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues. The httpd web server
must be restarted for the changes to take effect.

Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

http://rhn.redhat.com/errata/RHSA-2009-0337.html
http://www.redhat.com/security/updates/classification/#moderate

CVSS Score:
10.0

CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2008-3658
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
BugTraq ID: 30649
http://www.securityfocus.com/bid/30649
Bugtraq: 20090302 rPSA-2009-0035-1 php php-cgi php-imap php-mcrypt php-mysql php-mysqli php-pgsql php-soap php-xsl php5 php5-cgi php5-imap php5-mcrypt php5-mysql php5-mysqli php5-pear php5-pgsql php5-soap php5-xsl (Google Search)
http://www.securityfocus.com/archive/1/501376/100/0/threaded
Cert/CC Advisory: TA09-133A
http://www.us-cert.gov/cas/techalerts/TA09-133A.html
Debian Security Information: DSA-1647 (Google Search)
http://www.debian.org/security/2008/dsa-1647
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01451.html
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01465.html
http://security.gentoo.org/glsa/glsa-200811-05.xml
HPdes Security Advisory: HPSBTU02382
http://www.securityfocus.com/archive/1/498647/100/0/threaded
HPdes Security Advisory: HPSBUX02401
http://marc.info/?l=bugtraq&m=123376588623823&w=2
HPdes Security Advisory: HPSBUX02465
http://marc.info/?l=bugtraq&m=125631037611762&w=2
HPdes Security Advisory: SSRT080132
HPdes Security Advisory: SSRT090005
HPdes Security Advisory: SSRT090192
http://www.mandriva.com/security/advisories?name=MDVSA-2009:021
http://www.mandriva.com/security/advisories?name=MDVSA-2009:022
http://www.mandriva.com/security/advisories?name=MDVSA-2009:023
http://www.mandriva.com/security/advisories?name=MDVSA-2009:024
http://news.php.net/php.cvs/51219
http://www.openwall.com/lists/oss-security/2008/08/08/2
http://www.openwall.com/lists/oss-security/2008/08/13/8
http://osvdb.org/47484
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9724
http://www.redhat.com/support/errata/RHSA-2009-0350.html
http://secunia.com/advisories/31982
http://secunia.com/advisories/32148
http://secunia.com/advisories/32316
http://secunia.com/advisories/32746
http://secunia.com/advisories/32884
http://secunia.com/advisories/33797
http://secunia.com/advisories/35074
http://secunia.com/advisories/35306
SuSE Security Announcement: SUSE-SR:2008:018 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html
SuSE Security Announcement: SUSE-SR:2008:021 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00006.html
http://www.vupen.com/english/advisories/2008/2336
http://www.vupen.com/english/advisories/2008/3275
http://www.vupen.com/english/advisories/2009/0320
http://www.vupen.com/english/advisories/2009/1297
XForce ISS Database: php-imageloadfont-dos(44401)
https://exchange.xforce.ibmcloud.com/vulnerabilities/44401
Common Vulnerability Exposure (CVE) ID: CVE-2008-3660
HPdes Security Advisory: HPSBUX02431
http://marc.info/?l=bugtraq&m=124654546101607&w=2
HPdes Security Advisory: SSRT090085
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9597
http://www.securitytracker.com/id?1020994
http://secunia.com/advisories/35650
XForce ISS Database: php-curl-unspecified(44402)
https://exchange.xforce.ibmcloud.com/vulnerabilities/44402
Common Vulnerability Exposure (CVE) ID: CVE-2008-5498
http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html
BugTraq ID: 33002
http://www.securityfocus.com/bid/33002
http://downloads.securityfocus.com/vulnerabilities/exploits/33002-2.php
http://downloads.securityfocus.com/vulnerabilities/exploits/33002.php
http://osvdb.org/51031
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9667
http://securitytracker.com/id?1021494
http://secunia.com/advisories/34642
http://secunia.com/advisories/36701
SuSE Security Announcement: SUSE-SR:2009:008 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html
XForce ISS Database: php-imagerotate-info-disclosure(47635)
https://exchange.xforce.ibmcloud.com/vulnerabilities/47635
Common Vulnerability Exposure (CVE) ID: CVE-2008-5557
BugTraq ID: 32948
http://www.securityfocus.com/bid/32948
Debian Security Information: DSA-1789 (Google Search)
http://www.debian.org/security/2009/dsa-1789
http://archives.neohapsis.com/archives/fulldisclosure/2008-12/0477.html
HPdes Security Advisory: HPSBMA02492
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444
HPdes Security Advisory: SSRT100079
http://www.mandriva.com/security/advisories?name=MDVSA-2009:045
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10286
http://securitytracker.com/id?1021482
http://secunia.com/advisories/35003
SuSE Security Announcement: SUSE-SR:2009:004 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
XForce ISS Database: php-multibyte-bo(47525)
https://exchange.xforce.ibmcloud.com/vulnerabilities/47525
Common Vulnerability Exposure (CVE) ID: CVE-2009-0754
http://www.openwall.com/lists/oss-security/2009/01/30/1
http://www.openwall.com/lists/oss-security/2009/02/03/3
http://www.openwall.com/lists/oss-security/2009/02/25/3
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11035
http://www.securitytracker.com/id?1021979
http://secunia.com/advisories/34830
http://secunia.com/advisories/35007
https://usn.ubuntu.com/761-1/
CopyrightCopyright (c) 2009 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.