Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.68764
Category:Fedora Local Security Checks
Title:Fedora Core 13 FEDORA-2010-19011 (php-eaccelerator)
Summary:NOSUMMARY
Description:Description:
The remote host is missing an update to php-eaccelerator
announced via advisory FEDORA-2010-19011.

Update Information:

Security Enhancements and Fixes in PHP 5.3.4:

* Fixed crash in zip extract method (possible CWE-170).
* Paths with NULL in them (foo\0bar.txt) are now considered as invalid (CVE-2006-7243).
* Fixed a possible double free in imap extension (Identified by Mateusz Kocielski). (CVE-2010-4150).
* Fixed NULL pointer dereference in ZipArchive::getArchiveComment. (CVE-2010-3709).
* Fixed possible flaw in open_basedir (CVE-2010-3436).
* Fixed MOPS-2010-24, fix string validation. (CVE-2010-2950).
* Fixed symbolic resolution support when the target is a DFS share.
* Fixed bug #52929 (Segfault in filter_var with FILTER_VALIDATE_EMAIL with large amount of data) (CVE-2010-3710).

Key Bug Fixes in PHP 5.3.4 include:

* Added stat support for zip stream.
* Added follow_location (enabled by default) option for the http stream support.
* Added a 3rd parameter to get_html_translation_table. It now takes a charset hint, like htmlentities et al.
* Implemented FR #52348, added new constant ZEND_MULTIBYTE to detect zend multibyte at runtime.

Full upstream Changelog : http://www.php.net/ChangeLog-5.php#5.3.4

This update also provides php-eaccelerator and maniadrive packages rebuild against update php.

References:

[ 1 ] Bug #649056 - CVE-2010-3870 php: XSS mitigation bypass via utf8_decode()
https://bugzilla.redhat.com/show_bug.cgi?id=649056
[ 2 ] Bug #651206 - CVE-2010-3709 php: NULL pointer dereference in ZipArchive::getArchiveComment
https://bugzilla.redhat.com/show_bug.cgi?id=651206
[ 3 ] Bug #651682 - CVE-2010-4156 php information disclosure via mb_strcut()
https://bugzilla.redhat.com/show_bug.cgi?id=651682
[ 4 ] Bug #652836 - CVE-2009-5016 php: XSS and SQL injection bypass via crafted overlong UTF-8 encoded string
https://bugzilla.redhat.com/show_bug.cgi?id=652836
[ 5 ] Bug #660382 - CVE-2010-4409 php: getSymbol() integer overflow vulnerability
https://bugzilla.redhat.com/show_bug.cgi?id=660382
[ 6 ] Bug #656917 - CVE-2010-4150 php: Double free in the imap extension
https://bugzilla.redhat.com/show_bug.cgi?id=656917
[ 7 ] Bug #646684 - CVE-2010-3710 php: DoS in filter_var() via long email string
https://bugzilla.redhat.com/show_bug.cgi?id=646684

Solution: Apply the appropriate updates.

This update can be installed with the yum update program. Use
su -c 'yum update php-eaccelerator' at the command line.
For more information, refer to Managing Software with yum,
available at http://docs.fedoraproject.org/yum/.

http://www.securityspace.com/smysecure/catid.html?in=FEDORA-2010-19011

Risk factor : High

CVSS Score:
6.8

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2006-7243
http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
BugTraq ID: 44951
http://www.securityfocus.com/bid/44951
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158616.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159031.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158915.html
HPdes Security Advisory: HPSBOV02763
http://marc.info/?l=bugtraq&m=133469208622507&w=2
HPdes Security Advisory: HPSBUX02741
http://marc.info/?l=bugtraq&m=132871655717248&w=2
HPdes Security Advisory: SSRT100728
HPdes Security Advisory: SSRT100826
http://www.mandriva.com/security/advisories?name=MDVSA-2010:254
http://www.madirish.net/?article=436
http://openwall.com/lists/oss-security/2010/11/18/4
http://openwall.com/lists/oss-security/2010/11/18/5
http://openwall.com/lists/oss-security/2010/12/09/10
http://openwall.com/lists/oss-security/2010/12/09/11
http://openwall.com/lists/oss-security/2010/12/09/9
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12569
RedHat Security Advisories: RHSA-2013:1307
http://rhn.redhat.com/errata/RHSA-2013-1307.html
RedHat Security Advisories: RHSA-2013:1615
http://rhn.redhat.com/errata/RHSA-2013-1615.html
RedHat Security Advisories: RHSA-2014:0311
http://rhn.redhat.com/errata/RHSA-2014-0311.html
http://secunia.com/advisories/55078
Common Vulnerability Exposure (CVE) ID: CVE-2010-4150
BugTraq ID: 44980
http://www.securityfocus.com/bid/44980
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052845.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052836.html
http://www.mandriva.com/security/advisories?name=MDVSA-2010:239
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12489
http://www.securitytracker.com/id?1024761
http://secunia.com/advisories/42729
http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.490619
http://www.vupen.com/english/advisories/2010/3027
http://www.vupen.com/english/advisories/2010/3313
http://www.vupen.com/english/advisories/2011/0020
http://www.vupen.com/english/advisories/2011/0021
XForce ISS Database: php-phpimapc-dos(63390)
https://exchange.xforce.ibmcloud.com/vulnerabilities/63390
Common Vulnerability Exposure (CVE) ID: CVE-2010-3709
BugTraq ID: 44718
http://www.securityfocus.com/bid/44718
http://www.exploit-db.com/exploits/15431
HPdes Security Advisory: HPSBMA02662
http://marc.info/?l=bugtraq&m=130331363227777&w=2
HPdes Security Advisory: SSRT100409
http://www.mandriva.com/security/advisories?name=MDVSA-2010:218
http://www.redhat.com/support/errata/RHSA-2011-0195.html
http://www.securitytracker.com/id?1024690
http://secunia.com/advisories/42812
http://securityreason.com/achievement_securityalert/90
http://www.ubuntu.com/usn/USN-1042-1
http://www.vupen.com/english/advisories/2011/0077
Common Vulnerability Exposure (CVE) ID: CVE-2010-3436
http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
BugTraq ID: 44723
http://www.securityfocus.com/bid/44723
Common Vulnerability Exposure (CVE) ID: CVE-2010-2950
http://php-security.org/2010/05/14/mops-2010-024-php-phar_stream_flush-format-string-vulnerability/index.html
SuSE Security Announcement: SUSE-SR:2010:017 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
Common Vulnerability Exposure (CVE) ID: CVE-2010-3710
BugTraq ID: 43926
http://www.securityfocus.com/bid/43926
http://www.redhat.com/support/errata/RHSA-2011-0196.html
http://secunia.com/advisories/43189
SuSE Security Announcement: SUSE-SR:2010:023 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html
Common Vulnerability Exposure (CVE) ID: CVE-2010-3870
BugTraq ID: 44605
http://www.securityfocus.com/bid/44605
http://www.mandriva.com/en/security/advisories?name=MDVSA-2010:224
http://bugs.php.net/bug.php?id=48230
http://sirdarckcat.blogspot.com/2009/10/couple-of-unicode-issues-on-php-and.html
http://us2.php.net/manual/en/function.utf8-decode.php#83935
http://www.acunetix.com/blog/web-security-articles/security-risks-associated-with-utf8_decode/
http://www.blackhat.com/presentations/bh-usa-09/VELANAVA/BHUSA09-VelaNava-FavoriteXSS-SLIDES.pdf
http://www.openwall.com/lists/oss-security/2010/11/02/11
http://www.openwall.com/lists/oss-security/2010/11/02/2
http://www.openwall.com/lists/oss-security/2010/11/02/4
http://www.openwall.com/lists/oss-security/2010/11/02/6
http://www.openwall.com/lists/oss-security/2010/11/02/8
http://www.openwall.com/lists/oss-security/2010/11/02/1
http://www.openwall.com/lists/oss-security/2010/11/03/1
http://www.redhat.com/support/errata/RHSA-2010-0919.html
http://www.securitytracker.com/id?1024797
http://secunia.com/advisories/42410
http://www.vupen.com/english/advisories/2010/3081
Common Vulnerability Exposure (CVE) ID: CVE-2010-4156
BugTraq ID: 44727
http://www.securityfocus.com/bid/44727
http://www.mandriva.com/security/advisories?name=MDVSA-2010:225
http://pastie.org/1279428
http://pastie.org/1279682
http://www.openwall.com/lists/oss-security/2010/11/07/2
http://www.openwall.com/lists/oss-security/2010/11/08/13
http://secunia.com/advisories/42135
Common Vulnerability Exposure (CVE) ID: CVE-2009-5016
BugTraq ID: 44889
http://www.securityfocus.com/bid/44889
Common Vulnerability Exposure (CVE) ID: CVE-2010-4409
BugTraq ID: 45119
http://www.securityfocus.com/bid/45119
Bugtraq: 20101210 PHP 5.3.3 NumberFormatter::getSymbol Integer Overflow (Google Search)
http://www.securityfocus.com/archive/1/515142/100/0/threaded
CERT/CC vulnerability note: VU#479900
http://www.kb.cert.org/vuls/id/479900
http://www.exploit-db.com/exploits/15722
http://www.mandriva.com/security/advisories?name=MDVSA-2010:255
http://secunia.com/advisories/47674
SuSE Security Announcement: openSUSE-SU-2012:0100 (Google Search)
http://lists.opensuse.org/opensuse-updates/2012-01/msg00035.html
CopyrightCopyright (c) 2011 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2022 E-Soft Inc. All rights reserved.