=====================================================================
                                    CERT-Renater

                         Note d'Information No. 2007/VULN230
_____________________________________________________________________

DATE                      : 07/05/2007

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running PHP.

======================================================================
http://www.php.net/releases/4_4_7.php
http://www.php.net/releases/5_2_2.php
______________________________________________________________________

PHP 4.4.7 Release Announcement

The PHP development team would like to announce the immediate availability of
PHP 4.4.7. This release continues to improve the security and the stability of
the 4.4 branch and all users are strongly encouraged to upgrade to it as soon as
  possible.

Security Enhancements and Fixes in PHP 4.4.7:

     * Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan Fratric)
     * Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan Esser)
     * Fixed a bug in mb_parse_str() that can be used to activate 
register_globals (MOPB-26 by Stefan Esser)
     * Fixed unallocated memory access/double free in in 
array_user_key_compare() (MOPB-24 by Stefan Esser)
     * Fixed a double free inside session_regenerate_id() (MOPB-22 by Stefan Esser)
     * Added missing open_basedir & safe_mode checks to zip:// and bzip:// 
wrappers. (MOPB-21 by Stefan Esser).
     * Limit nesting level of input variables with max_input_nesting_level as 
fix for (MOPB-03 by Stefan Esser)
     * XSS in phpinfo() (MOPB-8 by Stefan Esser)
     * Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]Bug.Center.Team)
     * Fixed a possible super-global overwrite inside 
import_request_variables(). (by Stefano Di Paola, Stefan Esser)
     * Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc 
library. (by Stanislav Malyshev)

While majority of the issues outlined above are local, few issues such as the
XML-RPC overflows can be triggered remotely and therefor should be considered
critical. If you use the XML-RPC extension consider upgrading as soon as
possible.

Other improvements of PHP 4.4.7 include:

     * About 10 bug fixes.

For a full list of changes in PHP 4.4.7, see the ChangeLog.

--------------------------------------------------------------------------------

PHP 5.2.2 Release Announcement

The PHP development team would like to announce the immediate availability of
PHP 5.2.2. This release continues to improve the security and the stability of
the 5.X branch and all users are strongly encouraged to upgrade to it as soon as
possible.

Security Enhancements and Fixes in PHP 5.2.2:

     * Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan Fratric)
     * Fixed a header injection via Subject and To parameters to the mail() 
function (MOPB-34 by Stefan Esser)
     * Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan Esser)
     * Fixed wrong length calculation in unserialize S type (MOPB-29 by Stefan 
Esser)
     * Fixed a bug in mb_parse_str() that can be used to activate 
register_globals (MOPB-26 by Stefan Esser)
     * Fixed unallocated memory access/double free in in 
array_user_key_compare() (MOPB-24 by Stefan Esser)
     * Fixed a double free inside session_regenerate_id() (MOPB-22 by Stefan Esser)
     * Added missing open_basedir & safe_mode checks to zip:// and bzip:// 
wrappers. (MOPB-20, MOPB-21 by Stefan Esser).
     * Fixed substr_compare and substr_count information leak (MOPB-14 by Stefan 
Esser) (Stas, Ilia)
     * Limit nesting level of input variables with max_input_nesting_level as 
fix for (MOPB-03 by Stefan Esser)
     * Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]Bug.Center.Team)
     * Fixed a possible super-global overwrite inside 
import_request_variables(). (by Stefano Di Paola, Steffan Esser)
     * Fixed a remotely trigger-able buffer overflow inside 
make_http_soap_request(). (by Ilia Alshanetsky)
     * Fixed a buffer overflow inside user_filter_factory_create(). (by Ilia 
Alshanetsky)
     * Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc 
library. (by Stanislav Malyshev)

While majority of the issues outlined above are local, in some circumstances
given specific code paths they can be triggered externally. Therefor, we
strongly recommend that if you use code utilizing the functions and extensions
identified as having had vulnerabilities in them, you consider upgrading your
PHP.

The key improvements of PHP 5.2.2 include:

     * Further improvements to the Memory Manager with the goal of improving 
realloc() performance.
     * Bundled GD, SQLite and PCRE libraries were upgraded.
     * Additional methods were added to SPL's DirectoryIterator and SplFileInfo 
classes.
     * Over 120 bug fixes.

For users upgrading from PHP 5.0 and PHP 5.1, an upgrade guide is available
here, detailing the changes between those releases and PHP 5.2.2.

For a full list of changes in PHP 5.2.2, see the ChangeLog.



======================================================================

           =========================================================
           Les serveurs de référence du CERT-Renater
           http://www.urec.fr/securite
           http://www.cru.fr/securite
           http://www.renater.fr
           =========================================================
           + CERT-RENATER          | tel : 01-53-94-20-44          +
           + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
           + 75013 Paris           | email: certsvp@renater.fr     +
           =========================================================