oss-sec mailing list archives
Re: CVE request: php-5.2.6 overflow issues
From: "Steven M. Christey" <coley () linus mitre org>
Date: Tue, 12 Aug 2008 20:45:58 -0400 (EDT)
On Fri, 8 Aug 2008, Christian Hoffmann wrote:
two security issues, which might possibly allow for arbitrary code execution (afaik nobody has analyzed the details...), but at least DoS (think of FastCGI setups), were silently fixed in PHP again: * Overflow in ext/gd's imageloadfont() function [1] [2] [3]
Use CVE-2008-3658, to be filled in later - I'm assuming this is a distinct component that doesn't just affect PHP.
* Overflow in php's internal memnstr() function which is exposed to userspace as "explode()" [1] [2] [4] [5]
Use CVE-2008-3659. For the FastCGI "foo..php" issue, use CVE-2008-3660. These will be filled in later.
As those functions might take user-supplied data in certain webapps (which is a valid use case at least in case of explode()), those issues should probably expected to be remotely exploitable.
We use the term "context-dependent" to cover cases where the reachability and remote/local nature of the issue can vary widely, depending on how the product is used. This term typically applies to libraries or interpreters that are used by third-party applications. - Steve
Current thread:
- CVE request: php-5.2.6 overflow issues Christian Hoffmann (Aug 08)
- Re: CVE request: php-5.2.6 overflow issues Joe Orton (Aug 08)
- Re: CVE request: php-5.2.6 overflow issues Christian Hoffmann (Aug 08)
- Re: CVE request: php-5.2.6 overflow issues Joe Orton (Aug 08)
- Re: CVE request: php-5.2.6 overflow issues Christian Hoffmann (Aug 08)
- Re: CVE request: php-5.2.6 overflow issues Steven M. Christey (Aug 12)
- Re: CVE request: php-5.2.6 overflow issues Christian Hoffmann (Aug 13)
- Re: CVE request: php-5.2.6 overflow issues Joe Orton (Aug 08)