[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20101213163300.GD17679@redhat.com>
Date: Mon, 13 Dec 2010 09:33:00 -0700
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Issues without CVE names in PHP 5.3.4/5.2.15 release
Looking at the PHP web site, there are a few issues fixed in the most
recent releases that don't seem to have a CVE name:
* Fixed crash in zip extract method (possible CWE-170).
* Fixed symbolic resolution support when the target is a DFS share.
* Fixed extract() to do not overwrite $GLOBALS and $this when using EXTR_OVERWRITE.
Also doesn't seem to be much info on these readily available.
The first seems to be related to this SVN commit (don't see a bug for
it):
http://svn.php.net/viewvc?view=revision&revision=305848
The second seems to be Windows-specific and is this bug (haven't found
the SVN commit for it yet):
http://bugs.php.net/bug.php?id=51945
The third seems to be 5.2-specific (no mention in the 5.3 changes), but
I've not yet found the bug or SVN commit.
Do these have CVE names yet?
--
Vincent Danen / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
