Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 20 Nov 2009 10:47:35 +0000
From: Joe Orton <>
To: Thomas Biege <>
Cc: OSS-Security Mailinglist <>
Subject: Re: CVE request: php 5.3.1 update

On Fri, Nov 20, 2009 at 11:41:50AM +0100, Thomas Biege wrote:
> Hello,
> PHP was updated to version 5.3.1 and did also address security
> issues:

We assigned some CVE names for the new issues here; two correspond to 
existing issues fixed earlier in 5.2.11.  The CVE names have not made it 
to the web site but were used in the e-mail announcement text:

- Added missing sanity checks around exif processing. (CVE-2009-3292, Ilia)
- Fixed a safe_mode bypass in tempnam() identified by Grzegorz Stachowiak.
  (CVE-2009-3557, Rasmus)
- Fixed a open_basedir bypass in posix_mkfifo() identified by Grzegorz
  Stachowiak. (CVE-2009-3558, Rasmus)
- Fixed bug #50063 (safe_mode_include_dir fails). (CVE-2009-3559,
  Johannes, christian at elmerot dot se)
- Fixed bug #44683 (popen crashes when an invalid mode is passed).
  (CVE-2009-3294, Pierre)

Regards, Joe

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ