[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0904081401360.29367@faron.mitre.org>
Date: Wed, 8 Apr 2009 14:02:26 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: OSS Security <oss-security@...ts.openwall.com>
cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: PHP 5.2.9
On Wed, 1 Apr 2009, Tomas Hoger wrote:
> # Fixed a crash on extract in zip when files or directories entry names
> contain a relative path. (Pierre)
> http://cvs.php.net/viewvc.cgi/php-src/ext/zip/php_zip.c?r1=1.1.2.48&r2=1.1.2.49
>
> This should only affect php 5.2.7 or versions that have original fix
> for CVE-2008-5658 backported.
This was announced in 5.2.9 changelog though, so wouldn't 5.2.8 be
affected?
Use CVE-2009-1272
> # Fixed a segfault when malformed string is passed to json_decode().
Use CVE-2009-1271
- Steve
======================================================
Name: CVE-2009-1271
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1271
Reference: MLIST:[oss-security] 20090401 CVE request: PHP 5.2.9
Reference: URL:http://www.openwall.com/lists/oss-security/2009/04/01/9
Reference: MISC:http://cvs.php.net/viewvc.cgi/php-src/ext/json/JSON_parser.c?r1=1.1.2.14&r2=1.1.2.15
Reference: CONFIRM:http://www.php.net/releases/5_2_9.php
The JSON_parser function (ext/json/JSON_parser.c) in PHP 5.2.x before
5.2.9 allows remote attackers to cause a denial of service
(segmentation fault) via a malformed string to the json_decode API
function.
======================================================
Name: CVE-2009-1272
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1272
Reference: MLIST:[oss-security] 20090401 CVE request: PHP 5.2.9
Reference: URL:http://www.openwall.com/lists/oss-security/2009/04/01/9
Reference: MISC:http://cvs.php.net/viewvc.cgi/php-src/ext/json/JSON_parser.c?r1=1.1.2.14&r2=1.1.2.15
Reference: CONFIRM:http://www.php.net/releases/5_2_9.php
The php_zip_make_relative_path function in php_zip.c in PHP 5.2.x
before 5.2.9 allows context-dependent attackers to cause a denial of
service (crash) via a ZIP file that contains filenames with relative
paths, which is not properly handled during extraction.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
