php-5.3.3-3.AXS4.5
エラータID: AXSA:2012-30:01
リリース日:
2012/01/19 Thursday - 12:59
題名:
php-5.3.3-3.AXS4.5
影響のあるチャネル:
Asianux Server 4 for x86
Asianux Server 4 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
-PHP の 32ビットプラットフォームの exif_process_IFD_TAG 関数には整数オーバーフローが存在し，巧妙に細工された JPEG ファイルの EXIF ヘッダの offset_val 値によって，リモートの攻撃者が任意のメモリの場所の内容を読み込むことができたり，あるいはサービス拒否を引き起こす脆弱性があります。なお，この脆弱性は CVE-2011-0708 とは異なる脆弱性です。(CVE-2011-4566)
-PHP は フォームパラメータのハッシュ値をハッシュの衝突を引き起こさないように制限しておらず，多くの細工されたパラメータを送信することによって，リモートの攻撃者がサービス拒否 (CPU の消費) を引き起こす脆弱性があります。(CVE-2011-4885)
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2011-4566
Integer overflow in the exif_process_IFD_TAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-bit platforms allows remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offset_val value in an EXIF header in a JPEG file, a different vulnerability than CVE-2011-0708.
Integer overflow in the exif_process_IFD_TAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-bit platforms allows remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offset_val value in an EXIF header in a JPEG file, a different vulnerability than CVE-2011-0708.
CVE-2011-4885
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
CVE-2011-0708
exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) via an image with a crafted Image File Directory (IFD) that triggers a buffer over-read.
exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) via an image with a crafted Image File Directory (IFD) that triggers a buffer over-read.
CVE-2011-1148
Use-after-free vulnerability in the substr_replace function in PHP 5.3.6 and earlier allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by using the same variable for multiple arguments.
Use-after-free vulnerability in the substr_replace function in PHP 5.3.6 and earlier allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by using the same variable for multiple arguments.
CVE-2011-1466
Integer overflow in the SdnToJulian function in the Calendar extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via a large integer in the first argument to the cal_from_jd function.
Integer overflow in the SdnToJulian function in the Calendar extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via a large integer in the first argument to the cal_from_jd function.
CVE-2011-1468
Multiple memory leaks in the OpenSSL extension in PHP before 5.3.6 might allow remote attackers to cause a denial of service (memory consumption) via (1) plaintext data to the openssl_encrypt function or (2) ciphertext data to the openssl_decrypt function.
Multiple memory leaks in the OpenSSL extension in PHP before 5.3.6 might allow remote attackers to cause a denial of service (memory consumption) via (1) plaintext data to the openssl_encrypt function or (2) ciphertext data to the openssl_decrypt function.
CVE-2011-1469
Unspecified vulnerability in the Streams component in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) by accessing an ftp:// URL during use of an HTTP proxy with the FTP wrapper.
Unspecified vulnerability in the Streams component in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) by accessing an ftp:// URL during use of an HTTP proxy with the FTP wrapper.
CVE-2011-1471
Integer signedness error in zip_stream.c in the Zip extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (CPU consumption) via a malformed archive file that triggers errors in zip_fread function calls.
Integer signedness error in zip_stream.c in the Zip extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (CPU consumption) via a malformed archive file that triggers errors in zip_fread function calls.
CVE-2011-1938
Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c in PHP 5.3.3 through 5.3.6 might allow context-dependent attackers to execute arbitrary code via a long pathname for a UNIX socket.
Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c in PHP 5.3.3 through 5.3.6 might allow context-dependent attackers to execute arbitrary code via a long pathname for a UNIX socket.
CVE-2011-2202
The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows remote attackers to conduct absolute path traversal attacks, and possibly create or overwrite arbitrary files, via a crafted upload request, related to a "file path injection vulnerability."
The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows remote attackers to conduct absolute path traversal attacks, and possibly create or overwrite arbitrary files, via a crafted upload request, related to a "file path injection vulnerability."
CVE-2011-2483
crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash.
crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash.
追加情報:
N/A
ダウンロード:
SRPMS
- php-5.3.3-3.AXS4.5.src.rpm
MD5: c9e0af330a3a7d8b2240b2f046c3473e
SHA-256: 8e68171d652d3bd87cd25605e9296c52a9de90aeff5718f047ccb7f470d34c8a
Size: 10.23 MB
Asianux Server 4 for x86
- php-5.3.3-3.AXS4.5.i686.rpm
MD5: 4282cc73037d455df67d2493ef615908
SHA-256: 7b6051984bdf7edb3445e1a5564b247a22d3b359de020d9b62b87b3c515fd6db
Size: 1.11 MB - php-cli-5.3.3-3.AXS4.5.i686.rpm
MD5: 85b5ac9c2de4bcb353781eb68c6d2bbd
SHA-256: c6728d3826bd127403fe26815f115dd8470f0d24e0d0726518569dea4bc7128e
Size: 2.22 MB - php-common-5.3.3-3.AXS4.5.i686.rpm
MD5: 300b17ab2db592ed152ce81e02399f75
SHA-256: bd38a1546d08170d322444cb55bacbeb7c08df6f20ad28157feb815f60d12539
Size: 522.14 kB - php-gd-5.3.3-3.AXS4.5.i686.rpm
MD5: 0c04de828752e7d47bcb4a399483cb5f
SHA-256: 05cb706bd3254a2711b569c8f5c549cc34416de39d418e0b3587414ca65ff03f
Size: 101.54 kB - php-ldap-5.3.3-3.AXS4.5.i686.rpm
MD5: 128d172654742366c075e4a183267214
SHA-256: 9c53fbe1e443bfb5c972df01f37b6ca6f58ad118cbe0f9e37691f5f9667853aa
Size: 34.47 kB - php-mbstring-5.3.3-3.AXS4.5.i686.rpm
MD5: c69a51f677766cf1b27406fba102b81e
SHA-256: ee382962bd7e41f9d3f91d8022695fb41e24498ce0bfae381d0b07572f62fddb
Size: 451.84 kB - php-mysql-5.3.3-3.AXS4.5.i686.rpm
MD5: 0369b53ccb4a63c59bee350ac6f0fd6d
SHA-256: e897b13dcbe46092e4c2d6347214835a171f515630ffe04bfda64e8951dde0d6
Size: 75.57 kB - php-odbc-5.3.3-3.AXS4.5.i686.rpm
MD5: b8a41d90cf063b7c92ed0dc8803e5e26
SHA-256: b1547bee186a3ee573958bf565dfc0b6bffb17975f4b71df7a5710167b914cab
Size: 47.00 kB - php-pdo-5.3.3-3.AXS4.5.i686.rpm
MD5: bb41f8ef506bd9b0553b3af691d40ce4
SHA-256: d3ebcf7e03255a89f13a99360014fcb66be49f8443c34f3f0e260c18090d0f7e
Size: 71.14 kB - php-pgsql-5.3.3-3.AXS4.5.i686.rpm
MD5: cabecc2c01bbbb97ad53572df31159eb
SHA-256: e83ff464d4aaad6da1f6a46cf988d60d589a7b2a7adb46c561be60a58dc7b505
Size: 66.02 kB - php-soap-5.3.3-3.AXS4.5.i686.rpm
MD5: 762660767152d29b6424c8a104ba70e7
SHA-256: f7956c65afa82b7d994a3d21b590796b41cc7e67e605156142abf8be6d127fd6
Size: 138.11 kB - php-xml-5.3.3-3.AXS4.5.i686.rpm
MD5: e4419330a8b0dd4f6045432b59369208
SHA-256: 9c85c7daeaee596da442447102cd736814307465634c95da1e7b7db1634292fb
Size: 97.54 kB - php-xmlrpc-5.3.3-3.AXS4.5.i686.rpm
MD5: 3b45b7b85b30f91b557e42ecfaf92181
SHA-256: 3a203a3c8f1d3a4b7267b2c4cd52b65952dca233c1fffb10765cc4a997e75767
Size: 50.20 kB
Asianux Server 4 for x86_64
- php-5.3.3-3.AXS4.5.x86_64.rpm
MD5: 8d632b22f233d8a63f9712568efd324b
SHA-256: 405e1a2b7eb8833df7df096cfaf77751ec66d91c2d053e8145a4fd19b1b95d2d
Size: 1.12 MB - php-cli-5.3.3-3.AXS4.5.x86_64.rpm
MD5: 34a5a43d3ba7cb88e406aa465a2ee439
SHA-256: 8a78dfcc49c8c8adebdbede7810219702a326283b093728cdd4cf0eb078676af
Size: 2.17 MB - php-common-5.3.3-3.AXS4.5.x86_64.rpm
MD5: 08f42b85ac5c933583bb7bbb36660e0e
SHA-256: bb043f7aebb4eea7fa65ce2152d725ac0c1f9ca0f2eddc0099bb4641636c2888
Size: 520.88 kB - php-gd-5.3.3-3.AXS4.5.x86_64.rpm
MD5: 82c0afb1a263551968a49420cfe15e26
SHA-256: 73026f5c76fb2990becc5cc2fb2c3c8b5f47f3d06a7cdab76c2e8a1bd1eee95f
Size: 102.62 kB - php-ldap-5.3.3-3.AXS4.5.x86_64.rpm
MD5: 5121662e04cda606a0a4f522aefac0d1
SHA-256: a068d6072a3a5ab16cfdf11dae407b683e7fb49cc9af1a4b68b8a309bb2ebb95
Size: 34.83 kB - php-mbstring-5.3.3-3.AXS4.5.x86_64.rpm
MD5: 26f11ac27ac3e4bae3b523f0a594977f
SHA-256: aff396ac4b290609e3173a4570d714324dca08c5fecf21189cb3ae98ddf73164
Size: 451.76 kB - php-mysql-5.3.3-3.AXS4.5.x86_64.rpm
MD5: 9ff83d1630874b802cee566dea2491fd
SHA-256: a896cea03c40b9c7c260c5ef9d72f4afd779f43f8b09273092b557b2e9787623
Size: 77.76 kB - php-odbc-5.3.3-3.AXS4.5.x86_64.rpm
MD5: 8562eb1fcd7ea80d96d93d1c2b3c6f67
SHA-256: 3319d03f1887cd8938bb400d58312fca6dc7fab02da073ac6965326c4dab47e8
Size: 47.30 kB - php-pdo-5.3.3-3.AXS4.5.x86_64.rpm
MD5: f322566ab621ac92cc1f4f24aa4e8e8d
SHA-256: c58b98821ccffc32fd0c84d4af60aae3e28969c98dc5c98b49297aa443dba4bc
Size: 71.75 kB - php-pgsql-5.3.3-3.AXS4.5.x86_64.rpm
MD5: 44e5f9b5837b959de02b5dfc6a05cc22
SHA-256: 4fcb7ce027f23ac145ee84c47b96a9687105bf62dea971aa383541aff65fedcd
Size: 66.77 kB - php-soap-5.3.3-3.AXS4.5.x86_64.rpm
MD5: 66a428be936a3196c3ac58f313d51dc0
SHA-256: 915efb57b64cb54926bf2c4e4704e2336a9a0f52c00e4afac3799b7d223093ca
Size: 136.63 kB - php-xml-5.3.3-3.AXS4.5.x86_64.rpm
MD5: d1ecb50305ad5c4ad5a5ddf23a4b3f5e
SHA-256: edab5dd2a7c3c16656fb26440f388dd21877ec2cfa056b5e1e6fc298584eba97
Size: 99.06 kB - php-xmlrpc-5.3.3-3.AXS4.5.x86_64.rpm
MD5: 18151ebeb97a9802a88cba838e8e6515
SHA-256: ffe89589bd0b885b63cfb601b4b07bc248bacff0ecb3cc3b3e1eb1175681e855
Size: 49.08 kB