Bug 228858 - CVE-2007-0906 PHP security issues (CVE-2007-0907, CVE-2007-0908, CVE-2007-0909, CVE-2007-0910, CVE-2007-0988)
Summary: CVE-2007-0906 PHP security issues (CVE-2007-0907, CVE-2007-0908, CVE-2007-090...
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: php   
(Show other bugs)
Version: 4.0
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
: ---
Assignee: Joe Orton
QA Contact: David Lawrence
URL:
Whiteboard: source=internet,public=20070208,repor...
Keywords: Security
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-02-15 16:21 UTC by Joe Orton
Modified: 2007-11-30 22:07 UTC (History)
1 user (show)

Fixed In Version: RHSA-2007-0076
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-02-19 21:08:27 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2007:0076 normal SHIPPED_LIVE Important: php security update 2007-02-19 21:08:24 UTC

Description Joe Orton 2007-02-15 16:21:43 UTC
Description of problem:
1. If unserializing untrusted data on 64-bit platforms the
zend_hash_init() function can be forced to enter an infinite loop,
consuming CPU resources, for a limited length of time, until the
script timeout alarm aborts the script  (CVE-NO-NAME)

2. If a script uses the imap_mail_compose() function to create a new MIME
message based on an input body from an untrusted source, an attacker may be able
to force a heap overflow (CVE-2006-0906)

3. If the format string could passed to one of the functions in the printf()
family could be controlled by an attacker via untrusted data, then an
out-of-bounds memory read could crash the Apache child process (CVE-2006-0909)

4. If very long strings are passed to the str_replace() function then an integer
overflow could occur in memory allocation, which could lead to a heap buffer
overflow.  (CVE-2006-0906)

5. If the wddx extension is used to import WDDX data from an untrusted source,
certain WDDX input packets may allow a random portion of heap memory to be
exposed.  (CVE-2006-0908)

6. If the odbc_result_all() function is used to display
data from a database, and the contents of the database table are under
the control of an attacker, a format string vulnerability is possible.
(CVE-2006-0909)

7. Unspecified stack overflows and stack corruptions, and super-global clobbers
vulnerabilities in the session extension.  (CVE-2006-0906, CVE-2006-0910)

Affects: RHEL3, RHEL4

Comment 1 Mark J. Cox 2007-02-16 10:40:31 UTC
CVE-2007-0988 for " 1. If unserializing untrusted data on 64-bit platforms the
zend_hash_init() function can be forced to enter an infinite loop, consuming CPU
resources, for a limited length of time, until the script timeout alarm aborts
the script"


Comment 4 Red Hat Bugzilla 2007-02-19 21:08:27 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2007-0076.html



Note You need to log in before you can comment on or make changes to this bug.