Scientific Linux Security Update : php53 on SL5.x i386/x86_64
medium Nessus Plugin ID 60948
Language:
Synopsis
The remote Scientific Linux host is missing one or more security updates.Description
A flaw was found in the way PHP converted certain floating point values from string representation to a number. If a PHP script evaluated an attacker's input in a numeric context, the PHP interpreter could cause high CPU usage until the script execution time limit is reached. This issue only affected i386 systems.(CVE-2010-4645)
A stack memory exhaustion flaw was found in the way the PHP filter_var() function validated email addresses. An attacker could use this flaw to crash the PHP interpreter by providing excessively long input to be validated as an email address. (CVE-2010-3710)
A memory disclosure flaw was found in the PHP multi-byte string extension. If the mb_strcut() function was called with a length argument exceeding the input string size, the function could disclose a portion of the PHP interpreter's memory. (CVE-2010-4156)
After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
Solution
Update the affected packages.See Also
Plugin Details
Severity: Medium
ID: 60948
File Name: sl_20110203_php53_on_SL5_x.nasl
Version: 1.5
Type: local
Agent: unix
Published: 8/1/2012
Updated: 1/14/2021
Supported Sensors: Nessus Agent
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 5
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Vulnerability Information
CPE: x-cpe:/o:fermilab:scientific_linux
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RedHat/release, Host/RedHat/rpm-list
Patch Publication Date: 2/3/2011