Bug 480167 (CVE-2008-5814)

Summary:	CVE-2008-5814 php: XSS via PHP error messages
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	fedora, jorton, kreilly, rpm
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-5814
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-03-29 08:49:36 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	487368, 487369, 487370, 487371
Bug Blocks:

Description Tomas Hoger 2009-01-15 15:15:26 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-5814 to the following vulnerability:

Cross-site scripting (XSS) vulnerability in PHP, possibly 5.2.7 and earlier,
when display_errors is enabled, allows remote attackers to inject arbitrary web
script or HTML via unspecified vectors. NOTE: because of the lack of details,
it is unclear whether this is related to CVE-2006-0208.

References:
http://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000084.html
http://jvn.jp/en/jp/JVN50327700/index.html

Comment 1 Tomas Hoger 2009-01-15 15:17:05 UTC

PHP packages as shipped in Red Hat Enterprise Linux 4 and later set display_errors to off in the default php.ini configuration file.

Default setting for display_errors in PHP packages in Red Hat Enterprise Linux 2.1 and 3 is on.

Comment 7 Tomas Hoger 2009-04-06 14:57:09 UTC

Upstream patch:
http://viewcvs.php.net/viewvc.cgi/php-src/ext/standard/head.c?r1=1.84.2.1.2.8&r2=1.84.2.1.2.9&pathrev=PHP_5_2

Comment 8 errata-xmlrpc 2009-04-06 16:38:21 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:0338 https://rhn.redhat.com/errata/RHSA-2009-0338.html

Comment 9 errata-xmlrpc 2009-04-14 17:14:53 UTC

This issue has been addressed in following products:

  Red Hat Web Application Stack for RHEL 5

Via RHSA-2009:0350 https://rhn.redhat.com/errata/RHSA-2009-0350.html

Comment 10 Tomas Hoger 2010-03-29 08:50:42 UTC

This issue did not affect PHP versions in Red Hat Enterprise Linux 2.1, 3 and 4.