From 8405f4c7b3a5590289d371bb6ca1661867e5796b Mon Sep 17 00:00:00 2001 From: Bryan Drewery Date: Thu, 20 Sep 2012 03:02:43 +0000 Subject: [PATCH] - Update php52 backports patch to 20120911 - Add and update relevant vuxml entries Changes: - CVE-2011-1398 - The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 does not properly handle %0D sequences - CVE-2012-0789 - Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by triggering many strtotime function calls, which are not properly handled by the php_date_parse_tzfile cache. - CVE-2012-3365 - The SQLite functionality in PHP before 5.3.15 allows remote attackers to bypass the open_basedir protection mechanism via unspecified vectors - Timezone database updated to version 2012.5 (2012e) (from 2011.13 (2011m)) - Minor improvements (CVE-2012-2688, compilation issues with old GCC) PR: ports/171583 Submitted by: Svyatoslav Lempert Approved by: Alex Keda (maintainer) --- lang/php52/Makefile | 4 +- lang/php52/distinfo | 4 +- security/vuxml/vuln.xml | 88 ++++++++++++++++++++++++++++++++++++++++- 3 files changed, 90 insertions(+), 6 deletions(-) diff --git a/lang/php52/Makefile b/lang/php52/Makefile index 473a31311061..50f57ca5a5f9 100644 --- a/lang/php52/Makefile +++ b/lang/php52/Makefile @@ -7,7 +7,7 @@ PORTNAME= php52 PORTVERSION= 5.2.17 -PORTREVISION= 10 +PORTREVISION= 11 CATEGORIES?= lang devel www MASTER_SITES= ${MASTER_SITE_PHP} MASTER_SITE_SUBDIR= distributions @@ -26,7 +26,7 @@ USE_BZIP2= yes MAKE_JOBS_SAFE= yes # BACKPORTS patch for lang/php52 and all php52-extensions -PATCHFILES= php52-backports-security-20120721.patch +PATCHFILES= php52-backports-security-20120911.patch PATCH_SITES+= http://php52-backports.googlecode.com/files/ .if !defined(PKGNAMESUFFIX) diff --git a/lang/php52/distinfo b/lang/php52/distinfo index 2aa66a6b5206..6234d16a8ea1 100644 --- a/lang/php52/distinfo +++ b/lang/php52/distinfo @@ -1,7 +1,7 @@ SHA256 (php-5.2.17.tar.bz2) = e81beb13ec242ab700e56f366e9da52fd6cf18961d155b23304ca870e53f116c SIZE (php-5.2.17.tar.bz2) = 9092312 -SHA256 (php52-backports-security-20120721.patch) = a8ef22aaf2c7c1ff43d4154709a465f1ae6afaf1aeb1e6a39e274dcf36e33499 -SIZE (php52-backports-security-20120721.patch) = 306125 +SHA256 (php52-backports-security-20120911.patch) = 4911e2a5abb72d0558b2baf07ff64ca054d71219bde183e41b591894fb7cb1f6 +SIZE (php52-backports-security-20120911.patch) = 356599 SHA256 (php-5.2.14-fpm-0.5.14-freebsd.patch.gz) = 354ce451417d14ef47761ae55147e9cee30fa0ff6f59447da021194c539f4d7f SIZE (php-5.2.14-fpm-0.5.14-freebsd.patch.gz) = 43550 SHA256 (suhosin-patch-5.2.16-0.9.7.patch.gz) = aae115a318d80b3f32cedf876e7a8e4b932febb1b0c743c0b398003ebe122f91 diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index efcd275dea78..4f2217746a12 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -51,6 +51,82 @@ Note: Please add new entries to the beginning of this file. --> + + php5-sqlite -- open_basedir bypass + + + php5-sqlite + 5.25.2.17_11 + 5.35.3.15 + + + php52-sqlite + 5.2.17_11 + + + php53-sqlite + 5.3.15 + + + + +

MITRE CVE team reports:

+
+

The SQLite functionality in PHP before 5.3.15 allows remote + attackers to bypass the open_basedir protection mechanism via + unspecified vectors.

+
+ + + + CVE-2012-3365 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3365 + + + 2012-06-14 + 2012-09-19 + + + + + php5 -- Denial of Service in php_date_parse_tzfile() + + + php5 + 5.25.2.17_11 + 5.35.3.9 + + + php52 + 5.2.17_11 + + + php53 + 5.3.9 + + + + +

MITRE CVE team reports:

+
+

Memory leak in the timezone functionality in PHP before 5.3.9 + allows remote attackers to cause a denial of service (memory + consumption) by triggering many strtotime function calls, which are + not properly handled by the php_date_parse_tzfile cache.

+
+ + + + CVE-2012-0789 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0789 + https://bugs.php.net/bug.php?id=53502 + + + 2010-12-08 + 2012-09-19 + + + dns/bind9* -- Several vulnerabilities @@ -450,12 +526,13 @@ Note: Please add new entries to the beginning of this file. php5 - 5.25.3.11 + 5.25.2.17_11 + 5.35.3.11 5.45.4.1 php52 - 0 + 5.2.17_11 php53 @@ -485,6 +562,7 @@ Note: Please add new entries to the beginning of this file. 2011-11-06 2012-09-05 + 2012-09-19 @@ -14697,6 +14775,11 @@ Note: Please add new entries to the beginning of this file.

Paths with NULL in them (foo\0bar.txt) are now considered as invalid (CVE-2006-7243).

+
+

The php52 backports maintainer reports that this issue is unlikely + to be fixed in 5.2 due to design roadblocks. Users are strongly + encouraged to upgrade as soon as possible.

+
@@ -14707,6 +14790,7 @@ Note: Please add new entries to the beginning of this file. 2010-12-10 2011-01-13 + 2012-09-19