Date: Tue, 22 Mar 2016 17:05:54 -0500 From: Tyler Hicks <tyhicks@...onical.com> To: oss-security@...ts.openwall.com Cc: meissner@...e.de, cve-assign@...re.org, security@....net Subject: Re: Re: CVE Request: PHP last release security issues On 2016-03-16 16:42:30, cve-assign@...re.org wrote: > > https://bugs.php.net/bug.php?id=71610 > > >> Type Confusion Vulnerability - SOAP / make_http_soap_request() > > >> Due to an insufficient validation of the cookies field when making SOAP http request > > >> https://github.com/php/php-src/blob/master/ext/soap/php_http.c > > >> There is lack of validation of 2nd/3rd elements in cookies array. > >> > >> and a type confusion occurs when they are no longer string. > > >> [2016-02-22 07:48 UTC] stas@....net > >> Fix added to security repo as eaf4e77190d402ea014207e9a7d5da1a4f3727ba > > > https://git.php.net/?p=php-src.git;a=commit;h=eaf4e77190d402ea014207e9a7d5da1a4f3727ba > > >> + Z_TYPE_P(tmp) != IS_STRING || > > >> + Z_TYPE_P(tmp) != IS_STRING || > > Use CVE-2016-3185. I see a similar bug and fix in the PHP 5.x branch: https://bugs.php.net/bug.php?id=70081 https://git.php.net/?p=php-src.git;a=commitdiff;h=c96d08b27226193dd51f2b50e84272235c6aaa69 Note that the bug was filed in 2015. It was fixed in 5.6.12: https://secure.php.net/ChangeLog-5.php#5.6.12 Does CVE-2016-3185 cover the issue in 5.x, as well? Tyler Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.