-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2012.0099
                  php5 security update and regression fix
                              1 February 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           php5
Publisher:         Debian
Operating System:  Debian GNU/Linux 5
                   Debian GNU/Linux 6
Impact/Access:     Create Arbitrary Files -- Remote/Unauthenticated
                   Denial of Service      -- Remote/Unauthenticated
                   Reduced Security       -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2012-0057 CVE-2011-4885 CVE-2011-4566
                   CVE-2011-2483 CVE-2011-1938 

Reference:         ASB-2011.0118
                   ESB-2012.0068
                   ESB-2012.0012
                   ESB-2011.1099

Original Bulletin: 
   http://www.debian.org/security/2012/dsa-2399

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - -------------------------------------------------------------------------
Debian Security Advisory DSA-2399-2                   security@debian.org
http://www.debian.org/security/                           Thijs Kinkhorst
January 31, 2012                       http://www.debian.org/security/faq
- - -------------------------------------------------------------------------

Package        : php5
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2011-1938 CVE-2011-2483 CVE-2011-4566 CVE-2011-4885 
                 CVE-2012-0057 

A regression was found in the fix for PHP's XSLT transformations
(CVE-2012-0057). Updated packages are now available to address this
regression. For reference, the original advisory text follows.

Several vulnerabilities have been discovered in PHP, the web scripting
language. The Common Vulnerabilities and Exposures project identifies
the following issues:

CVE-2011-1938

  The UNIX socket handling allowed attackers to trigger a buffer overflow
  via a long path name.

CVE-2011-2483

  The crypt_blowfish function did not properly handle 8-bit characters,
  which made it easier for attackers to determine a cleartext password
  by using knowledge of a password hash.

CVE-2011-4566

  When used on 32 bit platforms, the exif extension could be used to
  trigger an integer overflow in the exif_process_IFD_TAG function
  when processing a JPEG file.

CVE-2011-4885

  It was possible to trigger hash collisions predictably when parsing
  form parameters, which allows remote attackers to cause a denial of
  service by sending many crafted parameters.

CVE-2012-0057

  When applying a crafted XSLT transform, an attacker could write files
  to arbitrary places in the filesystem.

NOTE: the fix for CVE-2011-2483 required changing the behaviour of this
function: it is now incompatible with some old (wrongly) generated hashes
for passwords containing 8-bit characters. See the package NEWS entry
for details. This change has not been applied to the Lenny version of PHP.

NOTE: at the time of release packages for some architectures are still
being built. They will be installed into the archive as soon as they
arrive.

For the oldstable distribution (lenny), these problems have been fixed
in version 5.2.6.dfsg.1-1+lenny15.

For the stable distribution (squeeze), these problems have been fixed
in version 5.3.3-7+squeeze6.

For the testing distribution (wheezy) and unstable distribution (sid),
these problems have been fixed in version 5.3.9-1.

We recommend that you upgrade your php5 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iQEcBAEBAgAGBQJPKAUcAAoJEOxfUAG2iX57Ct0IANOSodYkvOES0ARyuzHoj+wl
UJubCz4qt/FoUEQk8lmlmenH11Ny+W9bWNpzWuQXoOXGI9o10NNrV3+NtVeFsDZb
MpJEyrk9ES0kVlH9n2D7ajEz1BA550HGkdP8jJm+hCHb0gyBr/DaleVBpwBF/275
NGVKaYouYYEUpiua1tqRuxGI8Csd3EidJBhexFzMMwsNDqnTJWBbr1Fs+YvFNJE/
JcWLg8Dq/NJUfJNSJKVHBcA+v/CBSD1MXoqKyXdoHgdm7CrEIrT0kNvaZDLk8rN5
yONK+SUZOu8ZNEWLaxJQZdogg6wEGqxAWte6n5KbqyOlC0melVvvrxJY8FWo8f0=
=CVzr
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBTyiIne4yVqjM2NGpAQLqqBAAofBaOTkeQIA3CsZpv29iMgKi4DHNPyy+
iLclfGnR3s+l7z57PptZ3e5eIp5xDofQaGyyfAAuqbW1uMc2YuLtC8DUEY694M4u
QoQbR7liRkLB5HKNhZs5rheW/GOwp2Z55/49bQhbDerFlEoeGPo7iIH6BkDW+7pK
sNGT0A8UofODOdQOrlqXiE7hzM/TkfhSZOKMOm0VpnAcT8M1kXbI7GbACw2KtkH5
Cc9qMNsl4dUqm+0+GPfqNkKGslcV9OttHZGRQ1z9X2/Pxo8T6Ej3cxq64gdS/1bq
ml9qp6g7wdE23/e9Y/R9mplCswfSLOPH/QZbJV65snx9dr1I7R9f4BoAbFpPxf0w
Qe9UZ+Ukp+uv4Wvs3n4Acx1nXkdRMVjN4jHiWvRUC0goDMLqekW3qwqtovoDbZEf
QRezxpC7f7wKAhkartwsCgoPJrYdaHMH9zXZ4xSNivN2MoOvxc0Qm/JGm+ffnN8H
y6Zm5EWfwIeJYowkjdWkYr4P7re+d3KsnS3SE/FQMj0l73pqjNHV3DcttQqU+NpM
Vtocc7HHfBOH7wBxCTMMPvZLZ2Qt6LcMWpy8H1M6HPAHJ8z1srRes9vRCQS7J3fy
Wy/gLrzIqSkEuc23Q1y7kXxA5L2hMTddphSevR8Zq9XQkff3xz8Z6VwnqLvmAhkn
GcSfMEQZey8=
=y19+
-----END PGP SIGNATURE-----