Mandriva Linux Security Advisory : php-pear (MDVSA-2011:187)

A vulnerability has been discovered and corrected in php-pear : The installer in PEAR before 1.9.2 allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the 1 downloaddir, 2 cachedir, 3 tmpdir, and 4 pear-build-download directories, a different...

php-pear security and bug fix update

1.9.4-4 - fix patch application for 747361 1.9.4-3 - ignore REST cache creation failures as non-root user 747361 1.9.4-2 - fix XML-Util provides 1.9.4-1 - update to 1.9.4 651897 - update XMLRPC to 1.5.4, StructuresGraph to 1.0.4, ArchiveTar to 1.3.7 1.9.1-1 - update to 1.9.1 651897 - fix...

RHEL 6 : php-pear (RHSA-2011:1741)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2011:1741 advisory. The php-pear package contains the PHP Extension and Application Repository PEAR, a framework and distribution system for reusable PHP components. It...

Low: Red Hat Security Advisory: php-pear security and bug fix update

An updated php-pear package that fixes one security issue and multiple bugs is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severi...

php-pear: symlink vulnerability in PEAR installer

The installer in PEAR before 1.9.2 allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the 1 downloaddir, 2 cachedir, 3 tmpdir, and 4 pear-build-download directories, a different vulnerability than CVE-2007-2519...

Insecure RSA Encryption in jCryption, PEAR Crypt_RSA and Crypt_RSA2

SWITCH-CERT SECURITY ADVISORY ============================= Vulnerability: Insecure Implementation of RSA Encryption Affected Products: jCryption, PEAR CryptRSA, PEAR CryptRSA2 Advisory Date: 2011-11-30 Advisory Author: Daniel Roethlisberger, SWITCH-CERT Introduction Web applications using...

Security Release: Symfony 2.0.6

Symfony 2.0.6 has just been released. It addresses a security vulnerability in the EntityUserProvider as provided in the Doctrine bridge. If you let your users update their login/username from a form, and if you are using Doctrine as a user provider, then you are vulnerable and you should upgrade...

Mandriva Linux Security Advisory : php (MDVSA-2011:166)

A vulnerability has been identified and fixed in php : The isa function in PHP 5.3.7 and 5.3.8 triggers a call to the autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR...

CVE-2011-3379

The isa function in PHP 5.3.7 and 5.3.8 triggers a call to the autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders...

Code injection

The isa function in PHP 5.3.7 and 5.3.8 triggers a call to the autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders...

CVE-2011-3379

The isa function in PHP 5.3.7 and 5.3.8 triggers a call to the autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders...

CVE-2011-3379

CVE-2011-3379 : The is_a() function in PHP 5.3.7/5.3.8 can trigger __autoload, enabling remote attackers to execute arbitrary code by supplying a crafted URL and abusing unsafe autoloaders in certain PEAR packages. The issue is tied to PHP’s autoload behavior and the is_a() path, with public advi...

Jaws 0.8.14 Remote File Inclusion

================================ Jaws 0.8.14 Mullti Vulnerability ================================ 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=0 0 . .--. .--. .---. . 1 1 .'| / | 0 0 | --: --: / .-.| .-. . . 1 1 | / | | | 0 0 '---' --' --' ' -'--'---| 1 1 ; 0 0 Site : 1337day.com -' 1 1...

Security issue is_a function in PHP 5.3.7+

PHP 5.3.7 changed the behavior of the isa function, used to check if an object is an instance of a class, to call the autoload function. This causes a remote code execute problem when coupled with a standard library like PEAR that internally uses isa to check if a returned variable is an Error...

USN-1126-1: PHP vulnerabilities

Stephane Chazelas discovered that the /etc/cron.d/php5 cron job for PHP 5.3.5 allows local users to delete arbitrary files via a symlink attack on a directory under /var/lib/php5/. CVE-2011-0441 Raphael Geisert and Dan Rosenberg discovered that the PEAR installer allows local users to overwrite...

Fedora 13 2011-4102

PEAR is a framework and distribution system for reusable PHP components. This package contains the basic PEAR components. Update Information: According to https://fedorahosted.org/fpc/ticket/69 and to new PHP Guidelines, move %peardocdir /usr/share/pear/doc to %docdir/pear /usr/share/doc/pear...

Fedora 14 2011-4075

PEAR is a framework and distribution system for reusable PHP components. This package contains the basic PEAR components. Update Information: According to https://fedorahosted.org/fpc/ticket/69 and to new PHP Guidelines, move %peardocdir /usr/share/pear/doc to %docdir/pear /usr/share/doc/pear...

[SECURITY] Fedora 15 Update: php-pear-1.9.2-1.fc15

PEAR is a framework and distribution system for reusable PHP components. This package contains the basic PEAR components...

Fedora 15 : php-pear-1.9.2-1.fc15 (2011-2367)

Upstream Changelog : Important! This is a security fix release. The advisory can be found at http://pear.php.net/advisory-20110228.txt Bugs : - Fixed Bug 17463: Regression: On Windows, svntag patch by doconnor - Fixed Bug 17641: pecl-list doesn't sort packages by name dufuz - Fixed Bug 17781:...

CVE-2011-1144

The installer in PEAR 1.9.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the 1 downloaddir, 2 cachedir, 3 tmpdir, and 4 pear-build-download directories. NOTE: this vulnerability exists because of an incomplete fix for...