A security flaw was found in the way Round Cube Webmail, a browser-based multilingual IMAP client, processed certail email-messages containing URL link in the message Subject, when the Suhosin check for dangerous PHP files inclusion was enabled. A remote attacker could send a specially-crafted email message to the victim, leading to denial of service (situation, where victim could not open their mail INBOX folder with the crafted email message present). References: [1] http://trac.roundcube.net/ticket/1488086 [2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=646675 [3] https://bugs.php.net/bug.php?id=55475
Relevant upstream patch: [4] http://trac.roundcube.net/changeset/5222
Updated affected versions information: ====================================== The behaviour of is_a() PHP routine has been restored back to that one <= php-v5.3.6: See https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3379 for further information. Thus this means: ================ This issue did NOT affect the versions of the php-pear-MDB2 package, as shipped with Fedora release of 14 and 15. -- This issue did NOT affect the versions of the php-pear-MDB2 package, as shipped within Fedora EPEL 5 and Fedora EPEL 6 repositories.
Updated affected versions information: ====================================== The behaviour of is_a() PHP routine has been restored back to that one <= php-v5.3.6: See https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3379 for further information. Thus this means: ================ This issue did NOT affect the version of the roundcubemail package, as shipped with Fedora release of 14 and Fedora release of 15. -- This issue did NOT affect the versions of the roundcubemail package, as shipped with Fedora EPEL 6, Fedora EPEL 5, and Fedora EPEL 4.
CVE request: [5] http://www.openwall.com/lists/oss-security/2011/10/26/2
Created php-pear-MDB2 tracking bugs for this issue Affects: fedora-all [bug 749197] Affects: epel-6 [bug 749198] Affects: epel-5 [bug 749199]
Created roundcubemail tracking bugs for this issue Affects: fedora-15 [bug 749201] Affects: epel-6 [bug 749202]
This doesn't affect roundcubemail directly, we don't use the bundled version, we use system php-pear-MDB2.
Hi Jon, (In reply to comment #7) > This doesn't affect roundcubemail directly, we don't use the bundled version, > we use system php-pear-MDB2. Yes, that part about system php-pear-MDB2 is right. Though in the upstream patch there are also bits affecting direct roundcubemail code: trunk/roundcubemail/program/steps/mail/func.inc though not sure, how much important this change is to address the issue. Also, not sure in which package to search for this change from upstream commit: trunk/roundcubemail/program/lib/PEAR.php since it also doesn't seem to be directly shipped as part of roundcubemail package. Thanks for hints, Jan.
According to upstream bug, this is related to php 5.3.7-5.3.8 is_a() new behavior. So no version of RHEL provides this version. In all fedora branches, I have revert the is_a behavior to the previous one (in fact backport the 5.3.9 behavior). * Wed Sep 28 2011 Remi Collet <remi> 5.3.8-3 - revert is_a() to php <= 5.3.6 behavior (from upstream) with new option (allow_string) for new behavior So I really think we are not affected
See Bug #741020 CVE-2011-3379
This has been assigned the name CVE-2011-4078.
(In reply to comment #8) > Hi Jon, > > (In reply to comment #7) > > This doesn't affect roundcubemail directly, we don't use the bundled version, > > we use system php-pear-MDB2. > > Yes, that part about system php-pear-MDB2 is right. Though in the upstream > patch there are also bits affecting direct roundcubemail code: > > trunk/roundcubemail/program/steps/mail/func.inc > See Remi's answer. I believe this is OK. > though not sure, how much important this change is to address the issue. > > Also, not sure in which package to search for this change from upstream commit: > > trunk/roundcubemail/program/lib/PEAR.php > > since it also doesn't seem to be directly shipped as part of roundcubemail > package. > Correct. > Thanks for hints, Jan.
As noted in https://bugzilla.redhat.com/show_bug.cgi?id=749182#c9, the behaviour of the is_a() routine in php package, as shipped with Fedora 14, 15, and upcoming Fedora 16 has been reverted back to behaviour <= php-v5.3.6. See bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3379 for further details.
(In reply to comment #12) > See Remi's answer. I believe this is OK. Remi, Jon, thanks for your replies due this one. Updated affects information and closed the relevant child bugs. Closing this one too.