RHSA-2008:0546: Moderate: php security update

PHP is an HTML-embedded scripting language commonly used with the ApacheHTTP Web server.It was discovered that the PHP escapeshellcmd() function did not properlyescape multi-byte characters which are not valid in the locale used by thescript. This could allow an attacker to bypass quoting restrictions imposedby escapeshellcmd() and execute arbitrary commands if the PHP script wasusing certain locales. Scripts using the default UTF-8 locale are notaffected by this issue. (CVE-2008-2051)The PHP functions htmlentities() and htmlspecialchars() did not properlyrecognize partial multi-byte sequences. Certain sequences of bytes could bepassed through these functions without being correctly HTML-escaped.Depending on the browser being used, an attacker could use this flaw toconduct cross-site scripting attacks. (CVE-2007-5898)A PHP script which used the transparent session ID configuration option, orwhich used the outputaddrewritevar() function, could leak sessionidentifiers to external web sites. If a page included an HTML form with anACTION attribute referencing a non-local URL, the user's session ID wouldbe included in the form data passed to that URL. (CVE-2007-5899)It was discovered that PHP did not properly seed its pseudo-random numbergenerator used by functions such as rand() and mtrand(), possibly allowingan attacker to easily predict the generated pseudo-random values.(CVE-2008-2107, CVE-2008-2108)Integer overflow and memory requirements miscalculation issues werediscovered in the Perl-Compatible Regular Expression (PCRE) library used byPHP to process regular expressions. These issues could cause a crash, orpossibly execute an arbitrary code with the privileges of the PHP scriptthat processes regular expressions from untrusted sources. Note: PHPpackages shipped with Red Hat Enterprise Linux 2.1 did not use thesystem-level PCRE library. By default they used an embedded copy of thelibrary included with the PHP package. (CVE-2006-7228, CVE-2007-1660)Users of PHP should upgrade to these updated packages, which containbackported patches to correct these issues.