| Description: | Summary:
The remote host is missing an update for the 'php'
package(s) announced via the referenced advisory.
Vulnerability Insight:
Multiple vulnerabilities has been identified and fixed in php:
There is a programming error in the DES implementation used in crypt()
in ext/standard/crypt_freesec.c when handling input which contains
characters that can not be represented with 7-bit ASCII. When the input
contains characters with only the most significant bit set (0x80), that
character and all characters after it will be ignored (CVE-2012-2143).
An integer overflow, leading to heap-based buffer overflow was found in
the way Phar extension of the PHP scripting language processed certain
fields by manipulating TAR files. A remote attacker could provide a
specially-crafted TAR archive file, which once processed in an PHP
application using the Phar extension could lead to denial of service
(application crash), or, potentially arbitrary code execution with
the privileges of the user running the application (CVE-2012-2386).
The updated php packages have been upgraded to the 5.3.14 version
which is not vulnerable to these issues.
Affected Software/OS:
php on Mandriva Linux 2011.0,
Mandriva Enterprise Server 5.2,
Mandriva Linux 2010.1
Solution:
Please Install the Updated Packages.
CVSS Score:
7.5
CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
