aru Posted May 25, 2006 Report Share Posted May 25, 2006 Mandriva Advisories MDKSA-2006:091 : php Updated php packages fix vulnerabilities May 24th, 2006 An integer overflow in the wordwrap() function could allow attackers to execute arbitrary code via certain long arguments that cause a small buffer to be allocated, triggering a heap-based buffer overflow (CVE-2006-1990). The substr_compare() function in PHP 5.x and 4.4.2 could allow attackers to cause a Denial of Service (memory access violation) via an out-of-bounds offset argument (CVE-2006-1991). The second vulnerability only affects Mandriva Linux 2006; earlier versions shipped with older versions of PHP that do not contain the substr_compare() function. The released versions of Mandriva GNU/Linux affected are: CS3.0 MNF2.0 10.2 2006.0 Full information about this advisory, including the updated packages, is available at: wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:091 Other references: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1990 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1991 Posted automatically by aru (mdksec2mub v: mdksec2mub,v 0.15 2005/11/24 16:53:12 aru Exp aru $) Link to comment Share on other sites More sharing options...
Recommended Posts