[ MDVSA-2009:065 ] php4

[dude67]

_______________________________________________________________________

Package : php4
Date : March 5, 2009
Affected: Corporate 4.0
_______________________________________________________________________

Problem Description:

A vulnerability in the cURL library in PHP allowed context-dependent
attackers to bypass safe_mode and open_basedir restrictions and read
arbitrary files using a special URL request (CVE-2007-4850).

improve mbfl_filt_conv_html_dec_flush() error handling in
ext/mbstring/libmbfl/filters/mbfilter_htmlent.c (CVE-2008-5557).

PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows
local users to modify behavior of other sites hosted on the same
web server by modifying the mbstring.func_overload setting within
.htaccess, which causes this setting to be applied to other virtual
hosts on the same server (CVE-2009-0754).

The updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2007-4850
http://cve.mitre.org/cgi-bin/cvename.cg ... -2008-5557
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-0754
_______________________________________________________________________