GLSA-201001-03 : PHP: Multiple vulnerabilities

This script is Copyright (C) 2010-2014 Tenable Network Security, Inc.


Synopsis :

The remote Gentoo host is missing one or more security-related
patches.

Description :

The remote host is affected by the vulnerability described in GLSA-201001-03
(PHP: Multiple vulnerabilities)

Multiple vulnerabilities have been discovered in PHP. Please review the
CVE identifiers referenced below and the associated PHP release notes
for details.

Impact :

A context-dependent attacker could execute arbitrary code via a
specially crafted string containing an HTML entity when the mbstring
extension is enabled. Furthermore a remote attacker could execute
arbitrary code via a specially crafted GD graphics file.
A remote attacker could also cause a Denial of Service via a malformed
string passed to the json_decode() function, via a specially crafted
ZIP file passed to the php_zip_make_relative_path() function, via a
malformed JPEG image passed to the exif_read_data() function, or via
temporary file exhaustion. It is also possible for an attacker to spoof
certificates, bypass various safe_mode and open_basedir restrictions
when certain criteria are met, perform Cross-site scripting attacks,
more easily perform SQL injection attacks, manipulate settings of other
virtual hosts on the same server via a malicious .htaccess entry when
running on Apache, disclose memory portions, and write arbitrary files
via a specially crafted ZIP archive. Some vulnerabilities with unknown
impact and attack vectors have been reported as well.

Workaround :

There is no known workaround at this time.

See also :

http://www.gentoo.org/security/en/glsa/glsa-200911-03.xml
http://www.gentoo.org/security/en/glsa/glsa-201001-03.xml

Solution :

All PHP users should upgrade to the latest version. As PHP is
statically linked against a vulnerable version of the c-client library
when the imap or kolab USE flag is enabled (GLSA 200911-03), users
should upgrade net-libs/c-client beforehand:
# emerge --sync
# emerge --ask --oneshot --verbose '>=net-libs/c-client-2007e'
# emerge --ask --oneshot --verbose '>=dev-lang/php-5.2.12'

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 8.3
(CVSS2#E:F/RL:OF/RC:C)
Public Exploit Available : true