Fedora: php Multiple vulnerabilities
Summary
PHP is an HTML-embedded scripting language. PHP attempts to make it
easy for developers to write dynamically generated webpages. PHP also
offers built-in database integration for several commercial and
non-commercial database management systems, so writing a
database-enabled webpage with PHP is fairly simple. The most common
use of PHP coding is probably as a replacement for CGI scripts. The
mod_php module enables the Apache Web server to understand and process
the embedded PHP language in Web pages.
PHP is an HTML-embedded scripting language. PHP attempts to make it
easy for developers to write dynamically generated webpages. PHP also
offers built-in database integration for several commercial and
non-commercial database management systems, so writing a
database-enabled webpage with PHP is fairly simple. The most common
use of PHP coding is probably as a replacement for CGI scripts. The
mod_php module enables the Apache Web server to understand and process
the embedded PHP language in Web pages.
Update Information:
This update includes the latest release of PHP 4, including fixes for
security issues in memory limit handling (CVE CAN-2004-0594), and the
strip_tags function (CVE CAN-2004-0595). CAN-2004-0595 is not known
to be exploitable in the default configuration if using httpd 2.0.50,
but can be triggered if the "register_globals" setting has been
enabled. CAN-2004-0595 can allow a possible cross-site-scripting
attack with some browsers.
The mbstring extension has been moved into the php-mbstring subpackage
in this update to reduce the overall package size.
* Fri Jul 16 2004 Joe Orton <jorton@redhat.com> 4.3.8-2.1
- revert upstream default php.ini change since 4.3.6
- add three FD_SETSIZE changes to main/network.c (#125258)
* Wed Jul 14 2004 Joe Orton <jorton@redhat.com> 4.3.8-2.0
- update to 4.3.8 - add gmp_powm fix (Oskari Saarenmaa, #124318) - split out mbstring extension into php-mbstring subpackage - fix rebuild without bison/flex - have -devel require php of same release...
Read the Full AdvisoryChange Log
References
CORE 2: Fedora Update Notification FEDORA-2004-223 2004-07-23 Product : Fedora Core 2 Name : php Version : 4.3.8 Release : 2.1 Summary : The PHP HTML-embedded scripting language. (PHP: Hypertext Preprocessor) Description : PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated webpages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts. The mod_php module enables the Apache Web server to understand and process the embedded PHP language in Web pages.
Update Instructions
