-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 --------------------------------------------------------------------------
   Turbolinux Security Advisory TLSA-2006-23
   http://www.turbolinux.co.jp/security/
                                             security-team@turbolinux.co.jp
 --------------------------------------------------------------------------

 Original released date: 17 Aug 2006
 Last revised: 17 Aug 2006

 Package: php

 Summary: Buffer overflow

 More information:
    PHP is an HTML-embedded scripting language.
    Buffer overflow vulnerability exists in the sscanf function in the php.

 Impact:
    The vulnerability may allow remote attackers to execute arbitrary code.

 Affected Products:
    - Turbolinux Appliance Server 2.0
    - Turbolinux 10 Server x64 Edition
    - Turbolinux Appliance Server 1.0 Hosting Edition
    - Turbolinux Appliance Server 1.0 Workgroup Edition
    - Turbolinux 10 Server
    - Turbolinux Home
    - Turbolinux 10 F...
    - Turbolinux 10 Desktop
    - Turbolinux Multimedia
    - Turbolinux Personal
    - Turbolinux 8 Server
    - Turbolinux 8 Workstation
    - Turbolinux 7 Server


 <Turbolinux Appliance Server 2.0>

   Source Packages
   Size: MD5

   php4-4.3.11-5.src.rpm
     12338076 635068dd3e38554e7feb0ba7fa179d09

   Binary Packages
   Size: MD5

   php4-4.3.11-5.i586.rpm
      5230845 8863745569be65d6957778a892903524
   php4-gd-4.3.11-5.i586.rpm
        46797 04853e581cde8b3505f69c6dbb1b7d42
   php4-imap-4.3.11-5.i586.rpm
        12161 57d4e258cbff3d2b9885fffddbdf7cd7
   php4-ldap-4.3.11-5.i586.rpm
        35565 3b7ed8ddd88ef8607d35279f238202b0
   php4-manual-4.3.11-5.i586.rpm
      7503844 26c540cca7ba616906a19000e5a566d1
   php4-ming-4.3.11-5.i586.rpm
        46972 058949c4215c440e1dc9458e24a22fcd
   php4-mysql-4.3.11-5.i586.rpm
       111814 bc7b659330784ed31e0ba803feb07af5
   php4-pgsql-4.3.11-5.i586.rpm
        63491 bc8e3c9c460999c91689b2526a1e4324

 <Turbolinux 10 Server x64 Edition> 

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/x64/Server/10/updates/SRPMS/php4-4.3.9-12.src.rpm
     12360997 b6a934555745b0adf9e4b33cf92bfafc

   Binary Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/x64/Server/10/updates/RPMS/php4-4.3.9-12.x86_64.rpm
      5475308 562b5174c219d6e30d0ba5198aaf2501
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/x64/Server/10/updates/RPMS/php4-debug-4.3.9-12.x86_64.rpm
      6575054 7a508574ea3d69c704e7467855287ad3
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/x64/Server/10/updates/RPMS/php4-gd-4.3.9-12.x86_64.rpm
        50573 37ea3d39aa1b0e8a01a15dce519fa00a
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/x64/Server/10/updates/RPMS/php4-imap-4.3.9-12.x86_64.rpm
        10879 b5aeabc0eee9aa36ed900562dacccd3d
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/x64/Server/10/updates/RPMS/php4-ldap-4.3.9-12.x86_64.rpm
        38724 419314c410ecd78da85382e53b2ccfe5
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/x64/Server/10/updates/RPMS/php4-manual-4.3.9-12.x86_64.rpm
      7501949 f3a374f8737a02afd703c8fa2878a250
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/x64/Server/10/updates/RPMS/php4-ming-4.3.9-12.x86_64.rpm
        50838 d8c510704b12ec7368994578596be4da
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/x64/Server/10/updates/RPMS/php4-mysql-4.3.9-12.x86_64.rpm
       134185 41883d107c7016db862d9c980b69bb0a
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/x64/Server/10/updates/RPMS/php4-pgsql-4.3.9-12.x86_64.rpm
        75751 b49b5f881489752ee920de989aeb5fde

 <Turbolinux Appliance Server 1.0 Hosting Edition>

   Source Packages
   Size: MD5

   php-4.2.3-30.src.rpm
      3604597 5f625907fbe62a2ab300c9d10979543f

   Binary Packages
   Size: MD5

   php-4.2.3-30.i586.rpm
      1632831 677dcc3b333eb454ca6d222516487718
   php-gd-4.2.3-30.i586.rpm
        31928 78d36b6f324ac4d78e2e5b9745e71cf3
   php-imap-4.2.3-30.i586.rpm
         9763 9c4b0f07e8ce057b6180b10381823108
   php-ldap-4.2.3-30.i586.rpm
        25199 27615d59edd46c9cf76c7926fd335f4f
   php-manual-4.2.3-30.i586.rpm
       342060 4eeb68188565b033f526fa063dfe6b4e
   php-ming-4.2.3-30.i586.rpm
        33819 adcc7da45329e87ef54eb78a355904e5
   php-mysql-4.2.3-30.i586.rpm
        91435 3ff5daabd43d620f76c252117963d5ac
   php-pgsql-4.2.3-30.i586.rpm
        36059 d3da765cd52a66e48cd77bed0e12fc09

 <Turbolinux Appliance Server 1.0 Workgroup Edition>

   Source Packages
   Size: MD5

   php-4.2.3-30.src.rpm
      3604597 a5081fc873bff670aa4a614eef476cfb

   Binary Packages
   Size: MD5

   php-4.2.3-30.i586.rpm
      1633219 6f8a70b8125e7ff6f486a8e47dcd2773
   php-gd-4.2.3-30.i586.rpm
        32082 c7eb379fb5529d51efecff4e12aa2589
   php-imap-4.2.3-30.i586.rpm
         9906 f646ff6a0aeb218b6a65da333dc59d7c
   php-ldap-4.2.3-30.i586.rpm
        25337 1fc300d8421ae32e18c6ce8e5ac5e8d3
   php-manual-4.2.3-30.i586.rpm
       342313 40316d3c67645be69d6b16b78e03b30d
   php-ming-4.2.3-30.i586.rpm
        33955 70531e3703d446267cdabe6281f329a1
   php-mysql-4.2.3-30.i586.rpm
        91572 31123519bdca36e1918b998bf50181fc
   php-pgsql-4.2.3-30.i586.rpm
        36207 45c066ca45cc4294eee183982f21d8b2

 <Turbolinux 10 Server>

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/SRPMS/php4-4.3.11-5.src.rpm
     12338076 635068dd3e38554e7feb0ba7fa179d09

   Binary Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/php4-4.3.11-5.i586.rpm
      5230845 8863745569be65d6957778a892903524
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/php4-debug-4.3.11-5.i586.rpm
      6442010 e77d5cff1074455da1388752bd618b88
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/php4-gd-4.3.11-5.i586.rpm
        46797 04853e581cde8b3505f69c6dbb1b7d42
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/php4-imap-4.3.11-5.i586.rpm
        12161 57d4e258cbff3d2b9885fffddbdf7cd7
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/php4-ldap-4.3.11-5.i586.rpm
        35565 3b7ed8ddd88ef8607d35279f238202b0
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/php4-manual-4.3.11-5.i586.rpm
      7503844 26c540cca7ba616906a19000e5a566d1
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/php4-ming-4.3.11-5.i586.rpm
        46972 058949c4215c440e1dc9458e24a22fcd
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/php4-mysql-4.3.11-5.i586.rpm
       111814 bc7b659330784ed31e0ba803feb07af5
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/php4-pgsql-4.3.11-5.i586.rpm
        63491 bc8e3c9c460999c91689b2526a1e4324

 <Turbolinux 10 Desktop, Turbolinux 10 F..., Turbolinux Home, Turbolinux Multimedia, Turbolinux Personal>

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/updates/SRPMS/php4-4.3.3-18.src.rpm
      4188881 3ffe04db8e2f74143488c2ce550e441f

   Binary Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/updates/RPMS/php4-4.3.3-18.i586.rpm
      3407328 06a0d2c3456d12a68246bc08310e8515
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/updates/RPMS/php4-gd-4.3.3-18.i586.rpm
        31419 005d28dd8667555b37d3fccc9e0f18e9
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/updates/RPMS/php4-imap-4.3.3-18.i586.rpm
        10008 fc693c93d117a05b2745a7f4d16ba60b
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/updates/RPMS/php4-ldap-4.3.3-18.i586.rpm
        24390 384ebff79b0c30497afc7f8ae0c13ebd
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/updates/RPMS/php4-manual-4.3.3-18.i586.rpm
       342518 3580d07814cb9c1aa2d4626f4225db59
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/updates/RPMS/php4-ming-4.3.3-18.i586.rpm
        30881 b042ab1d63c31b0b0698c35203330114
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/updates/RPMS/php4-mysql-4.3.3-18.i586.rpm
        81904 870f8f0302fc656ae352f4a1aeb73323
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/updates/RPMS/php4-pgsql-4.3.3-18.i586.rpm
        48428 728feec06663b4f121a4df44d1e17099

 <Turbolinux 8 Server>

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/SRPMS/php-4.2.3-30.src.rpm
      3604597 8d469690e8d3189d37cfb07a61318f9b

   Binary Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/php-4.2.3-30.i586.rpm
      1632582 368a176fa64946448af13f221630deab
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/php-gd-4.2.3-30.i586.rpm
        32006 dd0bf71bf832c86685b8f5381fe4f382
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/php-imap-4.2.3-30.i586.rpm
         9860 009a1aaad3fa011c07b82f028df1e769
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/php-ldap-4.2.3-30.i586.rpm
        25312 79a35f45b9510b7b41cf244639e697d0
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/php-manual-4.2.3-30.i586.rpm
       342291 58bfaada1d4017eb701fc0bfa59f3640
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/php-ming-4.2.3-30.i586.rpm
        33881 462b84804e27111a0b83ef0b66658b27
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/php-mysql-4.2.3-30.i586.rpm
        91487 fcdf0cf2a64dbfb4a2c1139b14f272e3
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/updates/RPMS/php-pgsql-4.2.3-30.i586.rpm
        36111 af6579858a1c740870b4147079439a89

 <Turbolinux 7 Server>

   Source Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/SRPMS/php-4.2.3-30.src.rpm
      3604597 d9105611d84f2d8a523275682bd335c3

   Binary Packages
   Size: MD5

   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/php-4.2.3-30.i586.rpm
      1603951 0e8898cbb5c3ead9fd5f204138ce9557
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/php-imap-4.2.3-30.i586.rpm
         9866 8c0799465c048831b075ec329a441132
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/php-ldap-4.2.3-30.i586.rpm
        24885 c4ca5b057c7ae7368550fa962bfba6c9
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/php-manual-4.2.3-30.i586.rpm
       342293 c37a820dfa7d3672304b2901d604d89a
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/php-mysql-4.2.3-30.i586.rpm
        87254 e25b9ea4062a56009fbb7ab6cf3116ae
   ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/updates/RPMS/php-pgsql-4.2.3-30.i586.rpm
        35944 bfc64cbb38e467974eefab12aa5a9397


 CVE
   [CVE-2006-4020]
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4020

 --------------------------------------------------------------------------
 Revision History
    17 Aug 2006 Initial release
 --------------------------------------------------------------------------

 Copyright(C) 2006 Turbolinux, Inc. All rights reserved. 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)

iD8DBQFE5FskK0LzjOqIJMwRAtlxAJ4oP5lyalp8Hc1gmv69kfp7FnCKiQCeLHn8
nwEGL0FHf649+VYjD3fqK1g=
=8Nus
-----END PGP SIGNATURE-----