Bug 656917 (CVE-2010-4150)

Summary:	CVE-2010-4150 php: Double free in the imap extension
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	fedora, jorton, rpm
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-12-06 05:07:16 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	656932
Bug Blocks:

Description Jan Lieskovsky 2010-11-24 14:37:23 UTC

Mateusz Kocielski reported a deficiency in the way
PHP IMAP extension processed provided user credentials,
when opening user mailbox folder. A local attacker
could use this flaw to cause a denial of service
(particular php application crash) or, potentially,
execute arbitrary code with the privileges of the
user running the application, by providing
a specially-crafted user credentials.

References:
[1] http://svn.php.net/viewvc?view=revision&revision=305062
[2] http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/imap/php_imap.c?r1=294699&r2=305032&pathrev=305032&view=patch
[3] http://www.mandriva.com/en/security/advisories?name=MDVSA-2010:239
[4] http://www.vupen.com/english/advisories/2010/3027

Comment 1 Jan Lieskovsky 2010-11-24 14:40:30 UTC

This issue affects the versions of the php package, as shipped
with Red Hat Enterprise Linux 4, 5, and 6.

--

This issue affects the versions of the php package, as shipped
with Fedora release of 12, 13, and 14.

Please fix.

Comment 2 Jan Lieskovsky 2010-11-24 14:54:09 UTC

Created php tracking bugs for this issue

Affects: fedora-all [bug 656932]

Comment 5 Huzaifa S. Sidhpurwala 2010-11-29 07:20:15 UTC

Statement:

We do not consider safe_mode / open_basedir restriction bypass issues to be
security sensitive.  For more details see
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=169857#c1 and
http://www.php.net/security-note.php

Comment 6 Huzaifa S. Sidhpurwala 2010-12-06 05:07:16 UTC


*** This bug has been marked as a duplicate of bug 169857 ***