RHSA-2010:0919: Moderate: php security update

First published: Mon Nov 29 2010(Updated: )

PHP is an HTML-embedded scripting language commonly used with the Apache<br>HTTP Server.<br>An input validation flaw was discovered in the PHP session serializer. If a<br>PHP script generated session variable names from untrusted user input, a<br>remote attacker could use this flaw to inject an arbitrary variable into<br>the PHP session. (CVE-2010-3065)<br>An information leak flaw was discovered in the PHP var_export() function<br>implementation. If some fatal error occurred during the execution of this<br>function (such as the exhaustion of memory or script execution time limit),<br>part of the function's output was sent to the user as script output,<br>possibly leading to the disclosure of sensitive information.<br>(CVE-2010-2531)<br>A numeric truncation error and an input validation flaw were found in the<br>way the PHP utf8_decode() function decoded partial multi-byte sequences<br>for some multi-byte encodings, sending them to output without them being<br>escaped. An attacker could use these flaws to perform a cross-site<br>scripting attack. (CVE-2009-5016, CVE-2010-3870)<br>It was discovered that the PHP lcg_value() function used insufficient<br>entropy to seed the pseudo-random number generator. A remote attacker could<br>possibly use this flaw to predict values returned by the function, which<br>are used to generate session identifiers by default. This update changes<br>the function's implementation to use more entropy during seeding.<br>(CVE-2010-1128)<br>It was discovered that the PHP fnmatch() function did not restrict the<br>length of the pattern argument. A remote attacker could use this flaw to<br>crash the PHP interpreter where a script used fnmatch() on untrusted<br>matching patterns. (CVE-2010-1917)<br>A NULL pointer dereference flaw was discovered in the PHP XML-RPC<br>extension. A malicious XML-RPC client or server could use this flaw to<br>crash the PHP interpreter via a specially-crafted XML-RPC request.<br>(CVE-2010-0397)<br>All php users should upgrade to these updated packages, which contain<br>backported patches to resolve these issues. After installing the updated<br>packages, the httpd daemon must be restarted for the update to take effect.<br>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• collector/redhat-errata
• anchor-id/RHSA-2010:0919
• package-manager/redhat