php
201
A heap-based buffer overflow flaw was discovered in the pg_getline function implementation. If the
pg_getline or getline functions read large, untrusted records from a database, it could cause an
application using these functions to crash or, possibly, execute arbitrary code. (
CVE-2009-0663
1407
)
Note: After installing this update, pg_getline may return more data than specified by its second
argument, as this argument will be ignored. This is consistent with current upstream behavior.
Previously, the length limit (the second argument) was not enforced, allowing a buffer overflow.
A memory leak flaw was found in the function performing the de-quoting of BYTEA type values
acquired from a database. An attacker able to cause an application using perl-DBD-Pg to perform a
large number of SQL queries returning BYTEA records, could cause the application to use excessive
amounts of memory or, possibly, crash. (
CVE-2009-1341
1408
)
All users of perl-DBD-Pg are advised to upgrade to this updated package, which contains backported
patches to fix these issues. Applications using perl-DBD-Pg must be restarted for the update to take
effect.
1.173. php
1.173.1. RHSA-2009:0338: Moderate security update
Important
This update has already been released (prior to the GA of this release) as the security
errata
RHSA-2009:0338
1409
Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux
5.
This update has been rated as having moderate security impact by the Red Hat Security Response
Team.
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.
A heap-based buffer overflow flaw was found in PHP's mbstring extension. A remote attacker able
to pass arbitrary input to a PHP script using mbstring conversion functions could cause the PHP
interpreter to crash or, possibly, execute arbitrary code. (
CVE-2008-5557
1410
)
A flaw was found in the handling of the "mbstring.func_overload" configuration setting. A value set for
one virtual host, or in a user's .htaccess file, was incorrectly applied to other virtual hosts on the same
server, causing the handling of multibyte character strings to not work correctly. (
CVE-2009-0754
1411
)
A buffer overflow flaw was found in PHP's imageloadfont function. If a PHP script allowed a remote
attacker to load a carefully crafted font file, it could cause the PHP interpreter to crash or, possibly,
execute arbitrary code. (
CVE-2008-3658
1412
)
1407
https://www.redhat.com/security/data/cve/CVE-2009-0663.html
1408
https://www.redhat.com/security/data/cve/CVE-2009-1341.html
1410
https://www.redhat.com/security/data/cve/CVE-2008-5557.html
1411
https://www.redhat.com/security/data/cve/CVE-2009-0754.html
1412
https://www.redhat.com/security/data/cve/CVE-2008-3658.html
Summary of Contents for ENTERPRISE 5.4 RELEASE NOTES
Page 1: ...Red Hat Enterprise Linux 5 4 Technical Notes Every Change to Every Package ...
Page 18: ...xviii ...
Page 306: ...288 ...
Page 464: ...446 ...
Page 466: ...448 ...
