Ubuntu 4.10 : php4 vulnerabilities (USN-99-2)
Critical Nessus Plugin ID 20726
SynopsisThe remote Ubuntu host is missing one or more security-related patches.
DescriptionUSN-99-1 fixed a safe mode bypass which allowed malicious PHP scripts to circumvent path restrictions by creating a specially crafted directory whose length exceeded the capacity of the realpath() function (CAN-2004-1064). However, this caused severe regressions, some applications like SquirrelMail and Gallery did not work any more, and the package 'php4-pear' was empty. The current version repairs this.
In addition this update fixes a crash of the PHP interpreter if curl_init() was called with a non-string argument. Please note that this is not security relevant since this condition usually cannot be triggered externally.
Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
SolutionUpdate the affected packages.