(RHSA-2005:031) php security update

2005-01-19T05:00:00
ID RHSA-2005:031
Type redhat
Reporter RedHat
Modified 2018-03-14T19:28:10

Description

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

A double-free bug was found in the deserialization code of PHP. PHP applications use the unserialize function on untrusted user data, which could allow a remote attacker to gain access to memory or potentially execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1019 to this issue.

Flaws were found in the pack and unpack PHP functions. These functions do not normally pass user supplied data, so they would require a malicious PHP script to be exploited. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1018 to this issue.

A bug was discovered in the initialization of the OpenSSL library, such that the curl extension could not be used to perform HTTP requests over SSL unless the php-imap package was installed.

Users of PHP should upgrade to these updated packages, which contain fixes for these issues.