Debian Security Advisory
DSA-531-1 php4 -- several vulnerabilities
- Date Reported:
- 20 Jul 2004
- Affected Packages:
- php4
- Vulnerable:
- Yes
- Security database references:
- In Mitre's CVE dictionary: CVE-2004-0594, CVE-2004-0595.
- More information:
-
Two vulnerabilities were discovered in php4:
- CAN-2004-0594
The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete.
- CAN-2004-0595
The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\0) characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and facilitate the exploitation of cross-site scripting (XSS) vulnerabilities.
For the current stable distribution (woody), these problems have been fixed in version 4.1.2-7.
For the unstable distribution (sid), these problems have been fixed in version 4:4.3.8-1.
We recommend that you update your php4 package.
- CAN-2004-0594
- Fixed in:
-
Debian GNU/Linux 3.0 (woody)
- Source:
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7.dsc
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7.diff.gz
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2.orig.tar.gz
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7.diff.gz
- Architecture-independent component:
- http://security.debian.org/pool/updates/main/p/php4/php4-dev_4.1.2-7_all.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-pear_4.1.2-7_all.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-pear_4.1.2-7_all.deb
- Alpha:
- http://security.debian.org/pool/updates/main/p/php4/caudium-php4_4.1.2-7_alpha.deb
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7_alpha.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-cgi_4.1.2-7_alpha.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-curl_4.1.2-7_alpha.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-domxml_4.1.2-7_alpha.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-gd_4.1.2-7_alpha.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-imap_4.1.2-7_alpha.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-ldap_4.1.2-7_alpha.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mcal_4.1.2-7_alpha.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mhash_4.1.2-7_alpha.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mysql_4.1.2-7_alpha.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-odbc_4.1.2-7_alpha.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-recode_4.1.2-7_alpha.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-snmp_4.1.2-7_alpha.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-sybase_4.1.2-7_alpha.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-xslt_4.1.2-7_alpha.deb
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7_alpha.deb
- ARM:
- http://security.debian.org/pool/updates/main/p/php4/caudium-php4_4.1.2-7_arm.deb
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7_arm.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-cgi_4.1.2-7_arm.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-curl_4.1.2-7_arm.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-domxml_4.1.2-7_arm.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-gd_4.1.2-7_arm.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-imap_4.1.2-7_arm.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-ldap_4.1.2-7_arm.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mcal_4.1.2-7_arm.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mhash_4.1.2-7_arm.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mysql_4.1.2-7_arm.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-odbc_4.1.2-7_arm.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-recode_4.1.2-7_arm.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-snmp_4.1.2-7_arm.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-sybase_4.1.2-7_arm.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-xslt_4.1.2-7_arm.deb
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7_arm.deb
- Intel IA-32:
- http://security.debian.org/pool/updates/main/p/php4/caudium-php4_4.1.2-7.0.1_i386.deb
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7.0.1_i386.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-cgi_4.1.2-7.0.1_i386.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-curl_4.1.2-7.0.1_i386.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-domxml_4.1.2-7.0.1_i386.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-gd_4.1.2-7.0.1_i386.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-imap_4.1.2-7.0.1_i386.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-ldap_4.1.2-7.0.1_i386.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mcal_4.1.2-7.0.1_i386.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mhash_4.1.2-7.0.1_i386.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mysql_4.1.2-7.0.1_i386.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-odbc_4.1.2-7.0.1_i386.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-recode_4.1.2-7.0.1_i386.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-snmp_4.1.2-7.0.1_i386.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-sybase_4.1.2-7.0.1_i386.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-xslt_4.1.2-7.0.1_i386.deb
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7.0.1_i386.deb
- Intel IA-64:
- http://security.debian.org/pool/updates/main/p/php4/caudium-php4_4.1.2-7_ia64.deb
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7_ia64.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-cgi_4.1.2-7_ia64.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-curl_4.1.2-7_ia64.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-domxml_4.1.2-7_ia64.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-gd_4.1.2-7_ia64.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-imap_4.1.2-7_ia64.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-ldap_4.1.2-7_ia64.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mcal_4.1.2-7_ia64.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mhash_4.1.2-7_ia64.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mysql_4.1.2-7_ia64.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-odbc_4.1.2-7_ia64.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-recode_4.1.2-7_ia64.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-snmp_4.1.2-7_ia64.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-sybase_4.1.2-7_ia64.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-xslt_4.1.2-7_ia64.deb
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7_ia64.deb
- HPPA:
- http://security.debian.org/pool/updates/main/p/php4/caudium-php4_4.1.2-7_hppa.deb
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7_hppa.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-cgi_4.1.2-7_hppa.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-curl_4.1.2-7_hppa.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-domxml_4.1.2-7_hppa.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-gd_4.1.2-7_hppa.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-imap_4.1.2-7_hppa.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-ldap_4.1.2-7_hppa.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mcal_4.1.2-7_hppa.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mhash_4.1.2-7_hppa.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mysql_4.1.2-7_hppa.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-odbc_4.1.2-7_hppa.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-recode_4.1.2-7_hppa.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-snmp_4.1.2-7_hppa.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-sybase_4.1.2-7_hppa.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-xslt_4.1.2-7_hppa.deb
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7_hppa.deb
- Motorola 680x0:
- http://security.debian.org/pool/updates/main/p/php4/caudium-php4_4.1.2-7_m68k.deb
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7_m68k.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-cgi_4.1.2-7_m68k.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-curl_4.1.2-7_m68k.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-domxml_4.1.2-7_m68k.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-gd_4.1.2-7_m68k.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-imap_4.1.2-7_m68k.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-ldap_4.1.2-7_m68k.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mcal_4.1.2-7_m68k.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mhash_4.1.2-7_m68k.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mysql_4.1.2-7_m68k.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-odbc_4.1.2-7_m68k.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-recode_4.1.2-7_m68k.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-snmp_4.1.2-7_m68k.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-sybase_4.1.2-7_m68k.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-xslt_4.1.2-7_m68k.deb
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7_m68k.deb
- Big endian MIPS:
- http://security.debian.org/pool/updates/main/p/php4/caudium-php4_4.1.2-7_mips.deb
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7_mips.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-cgi_4.1.2-7_mips.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-curl_4.1.2-7_mips.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-domxml_4.1.2-7_mips.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-gd_4.1.2-7_mips.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-imap_4.1.2-7_mips.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-ldap_4.1.2-7_mips.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mcal_4.1.2-7_mips.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mhash_4.1.2-7_mips.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mysql_4.1.2-7_mips.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-odbc_4.1.2-7_mips.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-recode_4.1.2-7_mips.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-snmp_4.1.2-7_mips.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-sybase_4.1.2-7_mips.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-xslt_4.1.2-7_mips.deb
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7_mips.deb
- Little endian MIPS:
- http://security.debian.org/pool/updates/main/p/php4/caudium-php4_4.1.2-7_mipsel.deb
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7_mipsel.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-cgi_4.1.2-7_mipsel.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-curl_4.1.2-7_mipsel.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-domxml_4.1.2-7_mipsel.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-gd_4.1.2-7_mipsel.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-imap_4.1.2-7_mipsel.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-ldap_4.1.2-7_mipsel.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mcal_4.1.2-7_mipsel.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mhash_4.1.2-7_mipsel.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mysql_4.1.2-7_mipsel.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-odbc_4.1.2-7_mipsel.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-recode_4.1.2-7_mipsel.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-snmp_4.1.2-7_mipsel.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-sybase_4.1.2-7_mipsel.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-xslt_4.1.2-7_mipsel.deb
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7_mipsel.deb
- PowerPC:
- http://security.debian.org/pool/updates/main/p/php4/caudium-php4_4.1.2-7_powerpc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7_powerpc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-cgi_4.1.2-7_powerpc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-curl_4.1.2-7_powerpc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-domxml_4.1.2-7_powerpc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-gd_4.1.2-7_powerpc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-imap_4.1.2-7_powerpc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-ldap_4.1.2-7_powerpc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mcal_4.1.2-7_powerpc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mhash_4.1.2-7_powerpc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mysql_4.1.2-7_powerpc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-odbc_4.1.2-7_powerpc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-recode_4.1.2-7_powerpc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-snmp_4.1.2-7_powerpc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-sybase_4.1.2-7_powerpc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-xslt_4.1.2-7_powerpc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7_powerpc.deb
- IBM S/390:
- http://security.debian.org/pool/updates/main/p/php4/caudium-php4_4.1.2-7_s390.deb
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7_s390.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-cgi_4.1.2-7_s390.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-curl_4.1.2-7_s390.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-domxml_4.1.2-7_s390.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-gd_4.1.2-7_s390.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-imap_4.1.2-7_s390.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-ldap_4.1.2-7_s390.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mcal_4.1.2-7_s390.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mhash_4.1.2-7_s390.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mysql_4.1.2-7_s390.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-odbc_4.1.2-7_s390.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-recode_4.1.2-7_s390.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-snmp_4.1.2-7_s390.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-sybase_4.1.2-7_s390.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-xslt_4.1.2-7_s390.deb
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7_s390.deb
- Sun Sparc:
- http://security.debian.org/pool/updates/main/p/php4/caudium-php4_4.1.2-7_sparc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7_sparc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-cgi_4.1.2-7_sparc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-curl_4.1.2-7_sparc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-domxml_4.1.2-7_sparc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-gd_4.1.2-7_sparc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-imap_4.1.2-7_sparc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-ldap_4.1.2-7_sparc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mcal_4.1.2-7_sparc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mhash_4.1.2-7_sparc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-mysql_4.1.2-7_sparc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-odbc_4.1.2-7_sparc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-recode_4.1.2-7_sparc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-snmp_4.1.2-7_sparc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-sybase_4.1.2-7_sparc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4-xslt_4.1.2-7_sparc.deb
- http://security.debian.org/pool/updates/main/p/php4/php4_4.1.2-7_sparc.deb
MD5 checksums of the listed files are available in the original advisory.