Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:  Thu, 17 Dec 2009 13:23:33 -0600
From:  Raphael Geissert <>
Subject:  CVE request: php5: multiple issues

Hash: SHA1


Stefan Esser on his "Shocking News in PHP Exploitation"[1] presentation
reports and analyses a couple of issues:

* usort() interruption memory corruption:
uksort() although not mentioned on the presentation is also affected. It was
recently fixed in 5.2.12 but not considered security-relevant by upstream
* explode() information leak
* serialize() information leak

As mentioned by the presentation all these are local vulnerabilities.


Additionally, I've started to closely follow upstream development and found
the following issues that were or have not been mentioned anywhere else:

Null pointer dereference:

This one looks suspicious, basically a switch from sprintf to snprintf which
apparently already happened in the other branches at some point:

Improper decoding, not sure what the impact could be:

Insufficient memory allocation for unicode strings:

I think a cross-vendor security support and tracking effort for php5 is
needed. The number of issues silently fixed are a continuous risk, leaving
users exposed.
What does the others think?

- -- 
Raphael Geissert - Debian Developer -

Version: GnuPG v1.4.10 (GNU/Linux)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.