[Full-disclosure] rPSA-2007-0176-1 gd php php-mysql php-pgsql php5 php5-cgi php5-mysql php5-pear php5-pgsql php5-soap php5-xsl
rPath Update Announcements
announce-noreply at rpath.com
Wed Sep 5 17:09:11 BST 2007
rPath Security Advisory: 2007-0176-1
Products: rPath Linux 1
Exposure Level Classification:
Indirect User Deterministic Unauthorized Access
gd=/conary.rpath.com at rpl:devel//1/2.0.33-4.5-1
php=/conary.rpath.com at rpl:devel//1/4.3.11-15.13-1
php-mysql=/conary.rpath.com at rpl:devel//1/4.3.11-15.13-1
php-pgsql=/conary.rpath.com at rpl:devel//1/4.3.11-15.13-1
php5=/conary.rpath.com at rpl:1/5.2.3-7-1
php5-cgi=/conary.rpath.com at rpl:1/5.2.3-7-1
php5-mysql=/conary.rpath.com at rpl:1/5.2.3-7-1
php5-pear=/conary.rpath.com at rpl:1/5.2.3-7-1
php5-pgsql=/conary.rpath.com at rpl:1/5.2.3-7-1
php5-soap=/conary.rpath.com at rpl:1/5.2.3-7-1
php5-xsl=/conary.rpath.com at rpl:1/5.2.3-7-1
Previous versions of the gd, php, and php5 packages are vulnerable
to multiple attacks in which an attacker may cause unbounded CPU
consumption or application crashes (Denial of Service), possibly
leading to the execution of malicious code (Unauthorized Access).
These attacks are generally limited to uses of the gd library to load
existing images rather than generate new images. Many applications
that use gd (including all uses of gd within rPath Linux) us gd
only for generating new images, not for loading existing images.
While rPath Linux itself is not vulnerable to these attacks,
some uses of gd, particularly when loading attacker-supplied
images, will be vulnerable. Some applications which use gd
to load images supplied by remote users are web applications
written in PHP.
Copyright 2007 rPath, Inc.
This file is distributed under the terms of the MIT License.
A copy is available at http://www.rpath.com/permanent/mit-license.html
Full-Disclosure is hosted and sponsored by Secunia.