Debian Bug report logs - #704764
php5: CVE-2011-1398 results in PCI compliance scan fail

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Ronny Adsetts <ronny.adsetts@amazinginternet.com>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: php5: CVE-2011-1398 results in PCI compliance scan fail

Date: Fri, 05 Apr 2013 16:37:00 +0100

Package: php5
Version: 5.3.3-7+squeeze15
Severity: important

CVE-2011-1398 is unfixed in Debian Squeeze and is classified by Trustwave.com 
as a PCI compliance scan fail. As far as I can tell there's no way to mitigate
the problem short of building my own packages with upstream patches. I'm not
sure that this is within my capabilities as the initial fixes for this issue
were I think incomplete and resulted in CVE-2012-4388.

I've searched the Debian bugs for PHP and can't find reference to this issue.

Is there a change that CVE-2011-1398 (and therefore CVE-2012-4388) will be
fixed for Debian Squeeze with a security release?

Thanks.

Ronny


-- System Information:
Debian Release: 6.0.7
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.32-5-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages php5 depends on:
ii  libapache2-mod-php5    5.3.3-7+squeeze15 server-side, HTML-embedded scripti
ii  php5-common            5.3.3-7+squeeze15 Common files for packages built fr

php5 recommends no packages.

php5 suggests no packages.

-- no debconf information

Message #10 received at 704764@bugs.debian.org (full text, mbox, reply):

From: Lior Kaplan <kaplan@debian.org>

To: 704764@bugs.debian.org

Subject: more info

Date: Tue, 14 Jan 2014 02:18:19 +0200

[Message part 1 (text/plain, inline)]

More info at https://bugs.php.net/bug.php?id=60227

Relevant upstream patch:
http://git.php.net/?p=php-src.git;a=commitdiff;h=8e82bda330264d290a5e55580eea2eb875d4cb69

Kaplan

[Message part 2 (text/html, inline)]

Message #15 received at 704764-done@bugs.debian.org (full text, mbox, reply):

From: Ondřej Surý <ondrej@sury.org>

To: 614904-done@bugs.debian.org, 620015-done@bugs.debian.org, 704764-done@bugs.debian.org, 628054-done@bugs.debian.org, 620948-done@bugs.debian.org, 620423-done@bugs.debian.org, 620015-done@bugs.debian.org

Subject: Re: Closing bugs filled against php5 in oldstable

Date: Fri, 04 Jul 2014 15:00:44 +0200

Version: 5.4.4-14

One more batch...

On Fri, Jul 4, 2014, at 14:09, Ondřej Surý wrote:
> Version: 5.4.4-14
> 
> Hey all,
> 
> I am closing the bugs that were filled against php5 5.3 in Debian
> oldstable
> (well and earlier)...
> 
> Feel free to reopen the bug in you can reproduce it with php5 from
> current
> stable Debian release.
> 
> Cheers,
> -- 
> Ondřej Surý <ondrej@sury.org>
> Knot DNS (https://www.knot-dns.cz/) – a high-performance DNS server


-- 
Ondřej Surý <ondrej@sury.org>
Knot DNS (https://www.knot-dns.cz/) – a high-performance DNS server

Send a report that this bug log contains spam.