USN-99-2: Fixed php4 packages for USN-99-1

24 March 2005

php4 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 4.10

Software Description

Details

USN-99-1 fixed a safe mode bypass which allowed malicious PHP scripts to circumvent path restrictions by creating a specially crafted directory whose length exceeded the capacity of the realpath() function (CAN-2004-1064). However, this caused severe regressions, some applications like SquirrelMail and Gallery did not work any more, and the package ‘php4-pear’ was empty. The current version repairs this.

In addition this update fixes a crash of the PHP interpreter if curl_init() was called with a non-string argument. Please note that this is not security relevant since this condition usually cannot be triggered externally.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 4.10
libapache2-mod-php4
php4-cgi

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

References