Ubuntu Security Notice USN-99-2
24th March, 2005
php4 vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 4.10
Details
USN-99-1 fixed a safe mode bypass which allowed malicious PHP scripts
to circumvent path restrictions by creating a specially crafted
directory whose length exceeded the capacity of the realpath()
function (CAN-2004-1064). However, this caused severe regressions,
some applications like SquirrelMail and Gallery did not work any
more, and the package 'php4-pear' was empty. The current version
repairs this.
In addition this update fixes a crash of the PHP interpreter if
curl_init() was called with a non-string argument. Please note that
this is not security relevant since this condition usually cannot be
triggered externally.
Update instructions
The problem can be corrected by updating your system to the following package version:
- Ubuntu 4.10:
- libapache2-mod-php4
- php4-cgi
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
None