The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific attackers to obtain sensitive information (memory contents) and cause a PHP crash by using the ini_set function to declare a variable, then using the ini_restore function to restore the variable.

This update of PHP5 fixes :

  - CVE-2008-5625: CVSS v2 Base Score: 7.5 (HIGH)     (AV:N/AC:L/Au:N/C:P/I:P/A:P): Permissions, Privileges,     and Access Control (CWE-264) CVE-2008-5814: CVSS v2 Base     Score: 2.6 (LOW) (AV:N/AC:H/Au:N/C:N/I:P/A:N):
    Cross-Site Scripting (XSS) (CWE-79) CVE-2009-2626: CVSS     v2 Base Score: 6.4 (MEDIUM)     (AV:N/AC:L/Au:N/C:P/I:N/A:P): Other (CWE-Other)     CVE-2009-2687: CVSS v2 Base Score: 4.3 (MEDIUM)     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Input Validation (CWE-20)     CVE-2009-3546: CVSS v2 Base Score: 4.4 (moderate)     (AV:L/AC:M/Au:N/C:P/I:P/A:P): Other (CWE-Other)     CVE-2009-4017: CVSS v2 Base Score: 5.0 (moderate)     (AV:N/AC:L/Au:N/C:N/I:N/A:P): Other (CWE-Other)     CVE-2009-4142: CVSS v2 Base Score: 4.3 (MEDIUM)     (AV:N/AC:M/Au:N/C:N/I:P/A:N): Cross-Site Scripting     (XSS). (CWE-79). (CVE-2008-5624: CVSS v2 Base Score: 7.5     (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P): Permissions,     Privileges, and Access Control (CWE-264))

The remote host is affected by the vulnerability described in GLSA-201001-03 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the     CVE identifiers referenced below and the associated PHP release notes     for details.
  Impact :

    A context-dependent attacker could execute arbitrary code via a     specially crafted string containing an HTML entity when the mbstring     extension is enabled. Furthermore a remote attacker could execute     arbitrary code via a specially crafted GD graphics file.
    A remote attacker could also cause a Denial of Service via a malformed     string passed to the json_decode() function, via a specially crafted     ZIP file passed to the php_zip_make_relative_path() function, via a     malformed JPEG image passed to the exif_read_data() function, or via     temporary file exhaustion. It is also possible for an attacker to spoof     certificates, bypass various safe_mode and open_basedir restrictions     when certain criteria are met, perform Cross-site scripting attacks,     more easily perform SQL injection attacks, manipulate settings of other     virtual hosts on the same server via a malicious .htaccess entry when     running on Apache, disclose memory portions, and write arbitrary files     via a specially crafted ZIP archive. Some vulnerabilities with unknown     impact and attack vectors have been reported as well.
  Workaround :

    There is no known workaround at this time.

Several remote vulnerabilities have been discovered in the PHP 5 hypertext preprocessor. The Common Vulnerabilities and Exposures project identifies the following problems :

The following issues have been fixed in both the stable (lenny) and the oldstable (etch) distributions :

  - CVE-2009-2687 CVE-2009-3292     The exif module did not properly handle malformed jpeg     files, allowing an attacker to cause a segfault,     resulting in a denial of service.

  - CVE-2009-3291     The php_openssl_apply_verification_policy() function did     not properly perform certificate validation.

  - No CVE id yet

    Bogdan Calin discovered that a remote attacker could     cause a denial of service by uploading a large number of     files in using multipart/ form-data requests, causing     the creation of a large number of temporary files.

  To address this issue, the max_file_uploads option introduced in PHP   5.3.1 has been backported. This option limits the maximum number of   files uploaded per request. The default value for this new option is   50. See NEWS.Debian for more information.

The following issue has been fixed in the stable (lenny) distribution :

  - CVE-2009-2626     A flaw in the ini_restore() function could lead to a     memory disclosure, possibly leading to the disclosure of     sensitive data.

In the oldstable (etch) distribution, this update also fixes a regression introduced by the fix for CVE-2008-5658 in DSA-1789-1 (bug #527560).

This update of PHP5 fixes :

  - CVE-2008-5624: CVSS v2 Base Score: 7.5 (HIGH)     (AV:N/AC:L/Au:N/C:P/I:P/A:P) : Permissions, Privileges,     and Access Control (CWE-264)

  - CVE-2008-5625: CVSS v2 Base Score: 7.5 (HIGH)     (AV:N/AC:L/Au:N/C:P/I:P/A:P) : Permissions, Privileges,     and Access Control (CWE-264)

  - Cross-Site Scripting (XSS). (CWE-79). (CVE-2008-5814:
    CVSS v2 Base Score: 2.6 (LOW)     (AV:N/AC:H/Au:N/C:N/I:P/A:N))

  - CVE-2009-2626: CVSS v2 Base Score: 6.4 (MEDIUM)     (AV:N/AC:L/Au:N/C:P/I:N/A:P) : Other (CWE-Other)

  - CVE-2009-2687: CVSS v2 Base Score: 4.3 (MEDIUM)     (AV:N/AC:M/Au:N/C:N/I:N/A:P) : Input Validation (CWE-20)

  - CVE-2009-3546: CVSS v2 Base Score: 4.4 (moderate)     (AV:L/AC:M/Au:N/C:P/I:P/A:P) : Other (CWE-Other)

  - CVE-2009-4017: CVSS v2 Base Score: 5.0 (moderate)     (AV:N/AC:L/Au:N/C:N/I:N/A:P) : Other (CWE-Other)

  - Cross-Site Scripting (XSS) (CWE-79). (CVE-2009-4142:
    CVSS v2 Base Score: 4.3 (MEDIUM)     (AV:N/AC:M/Au:N/C:N/I:P/A:N))

This update of php5 fixes: CVE-2008-5624: CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P): Permissions, Privileges, and Access Control (CWE-264) CVE-2008-5625: CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P): Permissions, Privileges, and Access Control (CWE-264) CVE-2008-5814: CVSS v2 Base Score: 2.6 (LOW) (AV:N/AC:H/Au:N/C:N/I:P/A:N): Cross-Site Scripting (XSS) (CWE-79) CVE-2009-2626: CVSS v2 Base Score: 6.4 (MEDIUM) (AV:N/AC:L/Au:N/C:P/I:N/A:P): Other (CWE-Other) CVE-2009-2687: CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:N/A:P): Input Validation (CWE-20) CVE-2009-3546: CVSS v2 Base Score: 4.4 (moderate) (AV:L/AC:M/Au:N/C:P/I:P/A:P): Other (CWE-Other) CVE-2009-4017: CVSS v2 Base Score: 5.0 (moderate) (AV:N/AC:L/Au:N/C:N/I:N/A:P): Other (CWE-Other) CVE-2009-4142: CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N): Cross-Site Scripting (XSS) (CWE-79)

Multiple vulnerabilities has been found and corrected in php :

The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific attackers to obtain sensitive information (memory contents) and cause a PHP crash by using the ini_set function to declare a variable, then using the ini_restore function to restore the variable (CVE-2009-2626).

The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8 sequences, (2) invalid Shift_JIS sequences, and (3) invalid EUC-JP sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks by placing a crafted byte sequence before a special character (CVE-2009-4142).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.

The updated packages have been patched to correct these issues.

Maksymilian Arciemowicz discovered that PHP did not properly handle the ini_restore function. An attacker could exploit this issue to obtain random memory contents or to cause the PHP server to crash, resulting in a denial of service. (CVE-2009-2626)

It was discovered that the htmlspecialchars function did not properly handle certain character sequences, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain.
(CVE-2009-4142)

Stefan Esser discovered that PHP did not properly handle session data.
An attacker could exploit this issue to bypass safe_mode or open_basedir restrictions. (CVE-2009-4143).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
49829	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 6847)	Nessus	SuSE Local Security Checks	high
44892	GLSA-201001-03 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
44805	Debian DSA-1940-1 : php5 - multiple issues	Nessus	Debian Local Security Checks	high
44687	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 6846)	Nessus	SuSE Local Security Checks	high
44686	SuSE 11 Security Update : PHP5 (SAT Patch Number 1978)	Nessus	SuSE Local Security Checks	high
44683	openSUSE Security Update : apache2-mod_php5 (apache2-mod_php5-1993)	Nessus	SuSE Local Security Checks	high
44680	openSUSE Security Update : apache2-mod_php5 (apache2-mod_php5-1993)	Nessus	SuSE Local Security Checks	high
44678	openSUSE Security Update : apache2-mod_php5 (apache2-mod_php5-1993)	Nessus	SuSE Local Security Checks	high
44041	Mandriva Linux Security Advisory : php (MDVSA-2010:008)	Nessus	Mandriva Local Security Checks	medium
43897	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : php5 vulnerabilities (USN-882-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2009-2626

high

Tenable Plugins

high

critical

high

high

high

high

high

high

medium

critical