PHP 5.2.2 and PHP 4.4.7 发布

2007年05月05日 03:28 查看5727次 作者:   【
文章分类:PHP5研究[新]

 PHP开发小组日前发布了PHP 5.2.2及PHP 4.4.7,这两个版本主要用于改进5.x系列和4.4.x系列的安全性和稳定性,因此建议用户升级到该版本。关于更新的详情可参见PHP 5.2.2的发行公告PHP 5的更新列表,以及PHP 4.4.7的发行公告PHP 4的更新列表

 

  PHP开发小组日前发布了PHP 5.2.2及PHP 4.4.7,这两个版本主要用于改进5.x系列和4.4.x系列的安全性和稳定性,因此建议用户升级到该版本。关于更新的详情可参见PHP 5.2.2的发行公告PHP 5的更新列表,以及PHP 4.4.7的发行公告PHP 4的更新列表

  PHP 5.2.2及PHP 4.4.7中的主要改进:

  • 修复CVE-2007-1001,GD wbmp的无效图片尺寸缺陷
  • 修复main()函数中asciiz字节的截取缺陷
  • 修复mb_parse_str()函数中一个可能导致register_globals激活的缺陷
  • 修复array_user_key_compare()函数中访问未分配的内存的缺陷
  • 修复session_regenerate_id()函数中重复释放内存的缺陷
  • 添加 zip://和bzip://包装器中缺失的open_basedir和safe_mode检查
  • 限制max_input_nesting_level输出变量的内部级别
  • 修复ftp_putcmd()的CRLF注入缺陷
  • 修复import_request_variables()函数中可能存在的超全局覆盖缺陷
  • 修复libxmlrpc库中存在的远程可触发缓冲溢出


  PHP 5.2.2中的主要改进:

  • 修复mail()函数中可能过Subject和To参数进行头部注入的缺陷
  • 修复了计算unserialize S类型时长度不准确的缺陷
  • 修复substr_compare和substr_count的信息泄漏缺陷
  • 修复make_http_soap_request()函数中存在的远程可触发缓冲溢出
  • 修复user_filter_factory_create()函数中存在的缓冲溢出缺陷


  PHP 4.4.7中的主要改进:

  • 修复了phpinfo()函数中的跨站脚本缺陷


  以上的问题主要出现在本地主机,但在特定的条件下也可能通过远程触发。因此,开发小级建议使用了以上提及的可能存在弱点的函数或扩展库的用户进行升级。

  从PHP 5.0和PHP 5.1升级到PHP 5.2的用户,可参考手册上的升级指南

 

感谢

 

The PHP development team would like to announce the immediate availability of PHP 5.2.2 and availability of PHP 4.4.7. These releases are major stability and security enhancements of the 5.x and 4.4.x branches, and all users are strongly encouraged to upgrade to it as soon as possible. Further details about the PHP 5.2.2 release can be found in the release announcement for 5.2.2, the full list of changes is available in the ChangeLog for PHP 5. Details about the PHP 4.4.7 release can be found in the release announcement for 4.4.7, the full list of changes is available in the ChangeLog for PHP 4.

Security Enhancements and Fixes in PHP 5.2.2 and PHP 4.4.7:

  • Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan Fratric)
  • Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan Esser)
  • Fixed a bug in mb_parse_str() that can be used to activate register_globals (MOPB-26 by Stefan Esser)
  • Fixed unallocated memory access/double free in in array_user_key_compare() (MOPB-24 by Stefan Esser)
  • Fixed a double free inside session_regenerate_id() (MOPB-22 by Stefan Esser)
  • Added missing open_basedir & safe_mode checks to zip:// and bzip:// wrappers. (MOPB-21 by Stefan Esser).
  • Limit nesting level of input variables with max_input_nesting_level as fix for (MOPB-03 by Stefan Esser)
  • Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]Bug.Center.Team)
  • Fixed a possible super-global overwrite inside import_request_variables(). (by Stefano Di Paola, Stefan Esser)
  • Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library. (by Stanislav Malyshev)

Security Enhancements and Fixes in PHP 5.2.2 only:

  • Fixed a header injection via Subject and To parameters to the mail() function (MOPB-34 by Stefan Esser)
  • Fixed wrong length calculation in unserialize S type (MOPB-29 by Stefan Esser)
  • Fixed substr_compare and substr_count information leak (MOPB-14 by Stefan Esser) (Stas, Ilia)
  • Fixed a remotely trigger-able buffer overflow inside make_http_soap_request(). (by Ilia Alshanetsky)
  • Fixed a buffer overflow inside user_filter_factory_create(). (by Ilia Alshanetsky)

Security Enhancements and Fixes in PHP 4.4.7 only:

  • XSS in phpinfo() (MOPB-8 by Stefan Esser)

While majority of the issues outlined above are local, in some circumstances given specific code paths they can be triggered externally. Therefor, we strongly recommend that if you use code utilizing the functions and extensions identified as having had vulnerabilities in them, you consider upgrading your PHP.

For users upgrading to PHP 5.2 from PHP 5.0 and PHP 5.1, an upgrade guide is available here, detailing the changes between those releases and PHP 5.2.2.

Update: May 4th; The PHP 4.4.7 Windows build was updated due to the faulty Apache2 module shipped with the original

责任编辑:easy

给文章打分...

平均分:0.6(33 次)

-5 -4 -3 -2 -1 0 1 2 3 4 5
1

顶一下

发表我的见解...

  • 您的大名: 留空为匿名
  • 您的主页:
  • 您的邮箱: