Saturday, November 4, 2006

New PHP and Screen Packages

Three new packages has arrived in -stable tree and two of them are PHP packages. The first package was PHP 5.2.0 and this update is not placed in /patches, but rather in /extra as it includes a lot of changes, so automatic packages such as Swaret, Slapt-Get, or whatever will not download this packages, except when the authors wanted to (and make sure that his/her code is already PHP 5.2.0 compliant).

The next package is for PHP 4.4.x version which was patched to fix buffer overflow issue. The last package was screen which suffers from the same issue. All of them are already patched and ready to be used. Here are the latest -stable changelog:
Fri Nov 3 23:17:57 CST 2006
extra/php5/php-5.2.0-i486-1.tgz: Upgraded to php-5.2.0.
This release "includes a large number of new features, bug fixes and security enhancements." In particular, when the UTF-8 charset is selected there are buffer overflows in the htmlspecialchars() and htmlentities() that may be exploited to execute arbitrary code.
More details about the vulnerability may be found here:
Further details about the release can be found in the release announcement:
Some syntax has changed since PHP 5.1.x. An upgrading guide may be found at this location:
This package was placed in /extra rather than /patches to save people from possible surprises with automated upgrade tools, since users of PHP4 and PHP 5.1.x applications may need to make some code changes before things will work again.
(* Security fix *)

patches/packages/php-4.4.4-i486-4_slack11.0.tgz: Patched the UTF-8 overflow.
More details about the vulnerability may be found here:
(* Security fix *)

patches/packages/screen-4.0.3-i486-1_slack11.0.tgz: Upgraded to screen-4.0.3.
This addresses an issue with the way screen handles UTF-8 character encoding that could allow screen to be crashed (or possibly code to be executed in the context of the screen user) if a specially crafted sequence of pseudo-UTF-8 characters are displayed withing a screen session.
For more information, see:
(* Security fix *)