php5 (5.3.2-1ubuntu4.28) lucid-security; urgency=medium
* SECURITY UPDATE: denial of service via buffer overflow in mkgmtime()
- debian/patches/CVE-2014-3668.patch: properly handle sizes in
ext/xmlrpc/libxmlrpc/xmlrpc.c, added test to
ext/xmlrpc/tests/bug68027.phpt.
- CVE-2014-3668
* SECURITY UPDATE: integer overflow in unserialize()
- debian/patches/CVE-2014-3669.patch: fix overflow in
ext/standard/var_unserializer.{c,re}, added test to
ext/standard/tests/serialize/bug68044.phpt.
- CVE-2014-3669
* SECURITY UPDATE: Heap corruption in exif_thumbnail()
- debian/patches/CVE-2014-3670.patch: fix sizes in ext/exif/exif.c.
- CVE-2014-3670
* SECURITY UPDATE: out of bounds read in elf note headers in fileinfo()
- debian/patches/CVE-2014-3710.patch: validate note headers in
ext/fileinfo/libmagic/readelf.c.
- CVE-2014-3710
* SECURITY UPDATE: local file disclosure via curl NULL byte injection
- debian/patches/curl_embedded_null.patch: don't accept curl options
with embedded NULLs in ext/curl/interface.c, added test to
ext/curl/tests/bug68089.phpt.
- No CVE number
Date: 2014-10-29 11:45:12.934322+00:00
Changed-By: Marc Deslauriers <marc.deslauri...@canonical.com>
Signed-By: Ubuntu Archive Robot
<cjwatson+ubuntu-archive-ro...@chiark.greenend.org.uk>
https://launchpad.net/ubuntu/lucid/+source/php5/5.3.2-1ubuntu4.28
Sorry, changesfile not available.
--
Lucid-changes mailing list
Lucid-changes@lists.ubuntu.com
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/lucid-changes
