php security update

2006-11-0710:23:30

CentOS Project

lists.centos.org

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.492 Medium

EPSS

Percentile

97.5%

JSON

CentOS Errata and Security Advisory CESA-2006:0730

PHP is an HTML-embedded scripting language commonly used with the Apache
HTTP Web server.

The Hardened-PHP Project discovered an overflow in the PHP htmlentities()
and htmlspecialchars() routines. If a PHP script used the vulnerable
functions to parse UTF-8 data, a remote attacker sending a carefully
crafted request could trigger the overflow and potentially execute
arbitrary code as the ‘apache’ user. (CVE-2006-5465)

Users of PHP should upgrade to these updated packages which contain a
backported patch to correct this issue.

Affected packages:
php
php-devel
php-domxml
php-gd
php-imap
php-ldap
php-mbstring
php-mysql
php-ncurses
php-odbc
php-pear
php-pgsql
php-snmp
php-xmlrpc

Upstream details at:
https://access.redhat.com/errata/RHSA-2006:0730

OSVersionArchitecturePackageVersionFilename
CentOS3i386php< 4.3.2-37.entphp-4.3.2-37.ent.i386.rpm
CentOS3i386php-devel< 4.3.2-37.entphp-devel-4.3.2-37.ent.i386.rpm
CentOS3i386php-imap< 4.3.2-37.entphp-imap-4.3.2-37.ent.i386.rpm
CentOS3i386php-ldap< 4.3.2-37.entphp-ldap-4.3.2-37.ent.i386.rpm
CentOS3i386php-mysql< 4.3.2-37.entphp-mysql-4.3.2-37.ent.i386.rpm
CentOS3i386php-odbc< 4.3.2-37.entphp-odbc-4.3.2-37.ent.i386.rpm
CentOS3i386php-pgsql< 4.3.2-37.entphp-pgsql-4.3.2-37.ent.i386.rpm
CentOS3x86_64php< 4.3.2-37.entphp-4.3.2-37.ent.x86_64.rpm
CentOS3x86_64php-devel< 4.3.2-37.entphp-devel-4.3.2-37.ent.x86_64.rpm
CentOS3x86_64php-imap< 4.3.2-37.entphp-imap-4.3.2-37.ent.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	3	i386	php	< 4.3.2-37.ent	php-4.3.2-37.ent.i386.rpm
CentOS	3	i386	php-devel	< 4.3.2-37.ent	php-devel-4.3.2-37.ent.i386.rpm
CentOS	3	i386	php-imap	< 4.3.2-37.ent	php-imap-4.3.2-37.ent.i386.rpm
CentOS	3	i386	php-ldap	< 4.3.2-37.ent	php-ldap-4.3.2-37.ent.i386.rpm
CentOS	3	i386	php-mysql	< 4.3.2-37.ent	php-mysql-4.3.2-37.ent.i386.rpm
CentOS	3	i386	php-odbc	< 4.3.2-37.ent	php-odbc-4.3.2-37.ent.i386.rpm
CentOS	3	i386	php-pgsql	< 4.3.2-37.ent	php-pgsql-4.3.2-37.ent.i386.rpm
CentOS	3	x86_64	php	< 4.3.2-37.ent	php-4.3.2-37.ent.x86_64.rpm
CentOS	3	x86_64	php-devel	< 4.3.2-37.ent	php-devel-4.3.2-37.ent.x86_64.rpm
CentOS	3	x86_64	php-imap	< 4.3.2-37.ent	php-imap-4.3.2-37.ent.x86_64.rpm