Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:
Category:Mandrake Local Security Checks
Title:Mandriva Update for php MDVSA-2012:065 (php)
Summary:The remote host is missing an update for the 'php'; package(s) announced via the referenced advisory.
The remote host is missing an update for the 'php'
package(s) announced via the referenced advisory.

Vulnerability Insight:
Multiple vulnerabilities has been identified and fixed in php:

The PDORow implementation in PHP before 5.3.9 does not properly
interact with the session feature, which allows remote attackers to
cause a denial of service (application crash) via a crafted application
that uses a PDO driver for a fetch and then calls the session_start
function, as demonstrated by a crash of the Apache HTTP Server
(CVE-2012-0788). Note: this was fixed with php-5.3.10

The php_register_variable_ex function in php_variables.c in PHP
5.3.9 allows remote attackers to execute arbitrary code via a request
containing a large number of variables, related to improper handling
of array variables. NOTE: this vulnerability exists because of an
incorrect fix for CVE-2011-4885 (CVE-2012-0830). Note: this was fixed
with php-5.3.10

PHP before 5.3.10 does not properly perform a temporary change
to the magic_quotes_gpc directive during the importing of
environment variables, which makes it easier for remote attackers
to conduct SQL injection attacks via a crafted request, related to
main/php_variables.c, sapi/cgi/cgi_main.c, and sapi/fpm/fpm/fpm_main.c

Insufficient validating of upload name leading to corrupted $_FILES
indices (CVE-2012-1172).

The updated php packages have been upgraded to 5.3.11 which is not
vulnerable to these issues.

Stack-based buffer overflow in the suhosin_encrypt_single_cookie
function in the transparent cookie-encryption feature in the Suhosin
extension before 0.9.33 for PHP, when suhosin.cookie.encrypt and
suhosin.multiheader are enabled, might allow remote attackers to
execute arbitrary code via a long string that is used in a Set-Cookie
HTTP header (CVE-2012-0807). The php-suhosin packages has been upgraded
to the 0.9.33 version which is not affected by this issue.

Additionally some of the PECL extensions has been upgraded to their
latest respective versions which resolves various upstream bugs.

Affected Software/OS:
php on Mandriva Linux 2011.0,
Mandriva Linux 2010.1

Please Install the Updated Packages.

CVSS Score:

CVSS Vector:

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2012-0788
SuSE Security Announcement: SUSE-SU-2012:0411 (Google Search)
SuSE Security Announcement: openSUSE-SU-2012:0426 (Google Search)
Common Vulnerability Exposure (CVE) ID: CVE-2011-4885
BugTraq ID: 51193
Bugtraq: 20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table (Google Search)
CERT/CC vulnerability note: VU#903934
Debian Security Information: DSA-2399 (Google Search)
HPdes Security Advisory: HPSBMU02786
HPdes Security Advisory: HPSBOV02763
HPdes Security Advisory: HPSBUX02741
HPdes Security Advisory: SSRT100728
HPdes Security Advisory: SSRT100826
HPdes Security Advisory: SSRT100877
RedHat Security Advisories: RHSA-2012:0071
XForce ISS Database: php-hash-dos(72021)
Common Vulnerability Exposure (CVE) ID: CVE-2012-0830
BugTraq ID: 51830
Debian Security Information: DSA-2403 (Google Search)
HPdes Security Advisory: HPSBUX02791
HPdes Security Advisory: SSRT100856
RedHat Security Advisories: RHSA-2012:0092
XForce ISS Database: php-phpregistervariableex-code-exec(72911)
Common Vulnerability Exposure (CVE) ID: CVE-2012-0831
BugTraq ID: 51954
RedHat Security Advisories: RHSA-2013:1307
SuSE Security Announcement: SUSE-SU-2012:0472 (Google Search)
XForce ISS Database: php-magicquotesgpc-sec-bypass(73125)
Common Vulnerability Exposure (CVE) ID: CVE-2012-1172
Debian Security Information: DSA-2465 (Google Search)
SuSE Security Announcement: SUSE-SU-2012:0598 (Google Search)
SuSE Security Announcement: SUSE-SU-2012:0604 (Google Search)
Common Vulnerability Exposure (CVE) ID: CVE-2012-0807
CopyrightCopyright (c) 2012 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

© 1998-2022 E-Soft Inc. All rights reserved.