10 - USN-720-1

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS Ubuntu 7.10 Ubuntu 8.04 LTS Ubuntu 8.10

This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the following package versions:

Ubuntu 6.06 LTS:
libapache2-mod-php5 5.1.2-1ubuntu3.13
php5-cgi 5.1.2-1ubuntu3.13
php5-cli 5.1.2-1ubuntu3.13
php5-gd 5.1.2-1ubuntu3.13

Ubuntu 7.10:
libapache2-mod-php5 5.2.3-1ubuntu6.5
php5-cgi 5.2.3-1ubuntu6.5
php5-cli 5.2.3-1ubuntu6.5
php5-gd 5.2.3-1ubuntu6.5

Ubuntu 8.04 LTS:
libapache2-mod-php5 5.2.4-2ubuntu5.5
php5-cgi 5.2.4-2ubuntu5.5
php5-cli 5.2.4-2ubuntu5.5
php5-gd 5.2.4-2ubuntu5.5

Ubuntu 8.10:
libapache2-mod-php5 5.2.6-2ubuntu4.1
libapache2-mod-php5filter 5.2.6-2ubuntu4.1
php5-cgi 5.2.6-2ubuntu4.1
php5-cli 5.2.6-2ubuntu4.1
php5-gd 5.2.6-2ubuntu4.1

In general, a standard system upgrade is sufficient to effect the necessary changes.

Details follow:

It was discovered that PHP did not properly enforce php_admin_value and php_admin_flag restrictions in the Apache configuration file. A local attacker could create a specially crafted PHP script that would bypass intended security restrictions. This issue only applied to Ubuntu 6.06 LTS, 7.10, and 8.04 LTS. (CVE-2007-5900)

It was discovered that PHP did not correctly handle certain malformed font files. If a PHP application were tricked into processing a specially crafted font file, an attacker may be able to cause a denial of service and possibly execute arbitrary code with application privileges. (CVE-2008-3658)

It was discovered that PHP did not properly check the delimiter argument to the explode function. If a script passed untrusted input to the explode function, an attacker could cause a denial of service and possibly execute arbitrary code with application privileges. (CVE-2008-3659)

It was discovered that PHP, when used as FastCGI module, did not properly sanitize requests. By performing a request with multiple dots preceding the extension, an attacker could cause a denial of service. (CVE-2008-3660)

It was discovered that PHP did not properly handle Unicode conversion in the mbstring extension. If a PHP application were tricked into processing a specially crafted string containing an HTML entity, an attacker could execute arbitrary code with application privileges. (CVE-2008-5557)

It was discovered that PHP did not properly initialize the page_uid and page_gid global variables for use by the SAPI php_getuid function. An attacker could exploit this issue to bypass safe_mode restrictions. (CVE-2008-5624)

It was dicovered that PHP did not properly enforce error_log safe_mode restrictions when set by php_admin_flag in the Apache configuration file. A local attacker could create a specially crafted PHP script that would overwrite arbitrary files. (CVE-2007-5625)

It was discovered that PHP contained a flaw in the ZipArchive::extractTo function. If a PHP application were tricked into processing a specially crafted zip file that had filenames containing "..", an attacker could write arbitrary files within the filesystem. This issue only applied to Ubuntu 7.10, 8.04 LTS, and 8.10. (CVE-2008-5658)

USN-557-1 fixed a vulnerability in the GD library. When using the GD library, PHP did not properly handle the return codes that were added in the security update. An attacker could exploit this issue with a specially crafted image file and cause PHP to crash, leading to a denial of service. This issue only applied to Ubuntu 6.06 LTS, and 7.10. (CVE-2007-3996)