| Description: | Description:
The remote host is missing an update to php
announced via advisory MDVSA-2012:093.
Multiple vulnerabilities has been identified and fixed in php:
There is a programming error in the DES implementation used in crypt()
in ext/standard/crypt_freesec.c when handling input which contains
characters that can not be represented with 7-bit ASCII. When the input
contains characters with only the most significant bit set (0x80), that
character and all characters after it will be ignored (CVE-2012-2143).
An integer overflow, leading to heap-based buffer overflow was found in
the way Phar extension of the PHP scripting language processed certain
fields by manipulating TAR files. A remote attacker could provide a
specially-crafted TAR archive file, which once processed in an PHP
application using the Phar extension could lead to denial of service
(application crash), or, potentially arbitary code execution with
the privileges of the user running the application (CVE-2012-2386).
The updated php packages have been upgraded to the 5.3.14 version
which is not vulnerable to these issues.
Affected: 2010.1, 2011., Enterprise Server 5.0
Solution:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
http://www.securityspace.com/smysecure/catid.html?in=MDVSA-2012:093
http://www.php.net/ChangeLog-5.php#5.3.14
http://secunia.com/advisories/44335
Risk factor : High
|
