oss-security - Re: presumptive php sec holes

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Tue, 13 Oct 2009 10:25:15 +0200
From: yersinia <yersinia.spiros@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: presumptive php sec holes

On Mon, Oct 12, 2009 at 6:22 PM, Josh Bressers <bressers@...hat.com> wrote:
> ----- "Oden Eriksson" <oeriksson@...driva.com> wrote:
>
>> Hello.
>>
>> Attached are some php patches that to me looks security related
>> (unknown
>> impact). I hope someone with insight can classify and possible assign
>> CVE
>> numbers. The patches were taken from their svn repo, so it's
>> "official".
>>
>
> Did you contact PHP upstream about these? They're usually quite on the ball
> with understanding security flaws, so they are likely the best group to help
> you determine what the impact of these are.

These have probably  some refs

http://bugs.php.net/search.php?search_for=&boolean=1&limit=10&order_by=&direction=ASC&cmd=display&status=All&bug_type[]=Safe+Mode%2Fopen_basedir&php_os=&phpver=5.3&assign=&author_email=&bug_age=0

>
> --
>    JB
>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.