PHP: Multiple vulnerabilities
1.
Gentoo Linux Security Advisory
Version Information
| Advisory Reference |
GLSA 201110-06 / php |
| Release Date |
October 10, 2011 |
| Latest Revision |
October 10, 2011: 2 |
| Impact |
high |
| Exploitable |
local, remote |
| Package |
Vulnerable versions |
Unaffected versions |
Architecture(s) |
| dev-lang/php |
<
5.3.8 |
>=
5.3.8 |
All supported architectures
|
Related bugreports:
#306939, #332039, #340807, #350908, #355399, #358791, #358975, #369071, #372745, #373965, #380261
Synopsis
Multiple vulnerabilities were found in PHP, the worst of which
leading to remote execution of arbitrary code.
2.
Impact Information
Background
PHP is a widely-used general-purpose scripting language that is
especially suited for Web development and can be embedded into HTML.
Description
Multiple vulnerabilities have been discovered in PHP. Please review the
CVE identifiers referenced below for details.
Impact
A context-dependent attacker could execute arbitrary code, obtain
sensitive information from process memory, bypass intended access
restrictions, or cause a Denial of Service in various ways.
A remote attacker could cause a Denial of Service in various ways,
bypass spam detections, or bypass open_basedir restrictions.
3.
Resolution Information
Workaround
There is no known workaround at this time.
Resolution
All PHP users should upgrade to the latest version:
Code Listing 3.1: Resolution |
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/php-5.3.8"
|
4.
References
|