Date: Thu, 17 Dec 2009 13:23:33 -0600 From: Raphael Geissert <geissert@...ian.org> To: oss-security@...ts.openwall.com Subject: CVE request: php5: multiple issues -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Stefan Esser on his "Shocking News in PHP Exploitation" presentation reports and analyses a couple of issues: * usort() interruption memory corruption: uksort() although not mentioned on the presentation is also affected. It was recently fixed in 5.2.12 but not considered security-relevant by upstream * explode() information leak * serialize() information leak As mentioned by the presentation all these are local vulnerabilities. http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf Additionally, I've started to closely follow upstream development and found the following issues that were or have not been mentioned anywhere else: Null pointer dereference: http://svn.php.net/viewvc?view=revision&revision=292083 This one looks suspicious, basically a switch from sprintf to snprintf which apparently already happened in the other branches at some point: http://svn.php.net/viewvc?view=revision&revision=291888 Improper decoding, not sure what the impact could be: http://svn.php.net/viewvc?view=revision&revision=291586 Insufficient memory allocation for unicode strings: http://svn.php.net/viewvc?view=revision&revision=291259 I think a cross-vendor security support and tracking effort for php5 is needed. The number of issues silently fixed are a continuous risk, leaving users exposed. What does the others think? Regards, - -- Raphael Geissert - Debian Developer www.debian.org - get.debian.net -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iEYEARECAAYFAksqhTsACgkQYy49rUbZzlrm4ACcC/WIYLKRJO+UMKu7fZXCOZvp HaoAoIVrcx8oouZ8KcJZiDon7QITQgzB =u60p -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.