Fedora Core 5 : php-5.1.6-1.5 (2007-455)

high Nessus Plugin ID 25101

Synopsis

The remote Fedora Core host is missing a security update.

Description

This update fixes a number of security issues in PHP.

A denial of service flaw was found in the way PHP processed a deeply nested array. A remote attacker could cause the PHP interpreter to crash by submitting an input variable with a deeply nested array.
(CVE-2007-1285)

A flaw was found in the way the mbstring extension set global variables. A script which used the mb_parse_str() function to set global variables could be forced to enable the register_globals configuration option, possibly resulting in global variable injection.
(CVE-2007-1583)

A flaw was discovered in the way PHP's mail() function processed header data. If a script sent mail using a Subject header containing a string from an untrusted source, a remote attacker could send bulk e-mail to unintended recipients. (CVE-2007-1718)

A heap based buffer overflow flaw was discovered in PHP's gd extension. A script that could be forced to process WBMP images from an untrusted source could result in arbitrary code execution.
(CVE-2007-1001)

A buffer over-read flaw was discovered in PHP's gd extension. A script that could be forced to write arbitrary strings using a JIS font from an untrusted source could cause the PHP interpreter to crash.
(CVE-2007-0455)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 25101

File Name: fedora_2007-455.nasl

Version: 1.16

Type: local

Agent: unix

Family: Fedora Local Security Checks

Published: 4/30/2007

Updated: 1/11/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Vulnerability Information

CPE: p-cpe:/a:fedoraproject:fedora:php, p-cpe:/a:fedoraproject:fedora:php-bcmath, p-cpe:/a:fedoraproject:fedora:php-dba, p-cpe:/a:fedoraproject:fedora:php-debuginfo, p-cpe:/a:fedoraproject:fedora:php-devel, p-cpe:/a:fedoraproject:fedora:php-gd, p-cpe:/a:fedoraproject:fedora:php-imap, p-cpe:/a:fedoraproject:fedora:php-ldap, p-cpe:/a:fedoraproject:fedora:php-mbstring, p-cpe:/a:fedoraproject:fedora:php-mysql, p-cpe:/a:fedoraproject:fedora:php-ncurses, p-cpe:/a:fedoraproject:fedora:php-odbc, p-cpe:/a:fedoraproject:fedora:php-pdo, p-cpe:/a:fedoraproject:fedora:php-pgsql, p-cpe:/a:fedoraproject:fedora:php-snmp, p-cpe:/a:fedoraproject:fedora:php-soap, p-cpe:/a:fedoraproject:fedora:php-xml, p-cpe:/a:fedoraproject:fedora:php-xmlrpc, cpe:/o:fedoraproject:fedora_core:5

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Patch Publication Date: 4/18/2007

Reference Information

FEDORA: 2007-455

Detections

Analytics