Debian Bug report logs - #559787
php4: CVE-2008-5624

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Michael Gilbert <michael.s.gilbert@gmail.com>

To: submit@bugs.debian.org

Subject: php4: CVE-2008-5624

Date: Sun, 6 Dec 2009 22:17:57 -0500

Package: php4
Version: 6:4.4.4-8
Severity: serious
Tags: security

Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for php4.

CVE-2008-5624[0]:
| PHP 5 before 5.2.7 does not properly initialize the page_uid and
| page_gid global variables for use by the SAPI php_getuid function,
| which allows context-dependent attackers to bypass safe_mode
| restrictions via variable settings that are intended to be restricted
| to root, as demonstrated by a setting of /etc for the error_log
| variable.

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5624
    http://security-tracker.debian.org/tracker/CVE-2008-5624

Message #10 received at 559787@bugs.debian.org (full text, mbox, reply):

From: Raphael Geissert <geissert@debian.org>

To: Michael Gilbert <michael.s.gilbert@gmail.com>, 559787@bugs.debian.org

Cc: control@bugs.debian.org

Subject: Re: [php-maint] Bug#559787: php4: CVE-2008-5624

Date: Mon, 7 Dec 2009 00:24:20 -0600

severity 559787 important
thanks

Hi Michael,

safe_mode and open_basedir do not receive security support (see
README.Debian.security in php4-common and data/package-tags on the
tracker repo) and PHP4 is far behind security updates anyway.

Sean, apparently at some point you said you were going to prepare an
updated package, do you still plan to work on one?

Maybe another upload could be prepared addressing the most severe
issues and declaring the EOL of security support.

Cheers,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net

Message #17 received at 559787-done@bugs.debian.org (full text, mbox, reply):

From: Marco Rodrigues <gothicx@gmail.com>

To: 559787-done@bugs.debian.org

Subject: Package php4 has been removed from Debian

Date: Wed, 24 Mar 2010 20:20:17 +0000 (WET)

Version: 6:4.4.6-2+rm

You filed the bug http://bugs.debian.org/559787 in Debian BTS
against the package php4. I'm closing it at *unstable*, but it will
remain open for older distributions.

For more information about this package's removal, read
http://bugs.debian.org/428266. That bug might give the reasons why
this package was removed and suggestions of possible replacements.

Don't hesitate to reply to this mail if you have any question.

Thank you for your contribution to Debian.

--
Marco Rodrigues

Send a report that this bug log contains spam.