Marcello Barnaba
18/11/06, 14:37
--nextPart4046912.7uUuGbioyB
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
On Tuesday 14 November 2006 17:32, Stefan Esser wrote:
> =A0 Application: Dotdeb PHP < 5.2.0 Rev 3
> =A0 =A0 =A0Severity: Calling PHP scripts with special crafted URLs
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0can result in arbitrary email header injec=
tion
> =A0 =A0 =A0 =A0 =A0Risk: Critical
> Vendor Status: Vendor has fixed this with Dotdeb PHP 5.2.0 rev 3
As far as I can see, the package diff for php4.4.4=20
http://packages.dotdeb.org/dists/stable/php4/source/php4_4.4.4-0.dotdeb.1.d=
iff.gz
contains the vulnerable patch as well.
I wasn't unable to find a security contact (or even A contact) on dotdeb's =
web=20
site, nor I could find a version control system from which i could abstract=
=20
easily the security patch in order to easily backport it myself.
As a dotdeb user i'm a bit disappointed, but i also know that's because i=20
didn't check when i chose dotdeb as my php4 backporter for sarge, so i have=
=20
very little to complain.
Anyway, will the maintainer provide updated php4 packages as well?
=46or those of you interested in upgrading today, here is a diff between th=
e=20
php4 mail patch and the new php5 mail patch: http://ca.pastebin.com/824455
=2D-=20
pub 1024D/8D2787EF 723C 7CA3 3C19 2ACE 6E20 9CC1 9956 EB3C 8D27 87EF
--nextPart4046912.7uUuGbioyB
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
iD8DBQBFWjJymVbrPI0nh+8RAq/CAJ0XsZwFYP9e9B95gAlwzwKPlL6a8QCcCdeJ
WoSH9NUENl3oksyLl8mrwXs=
=yug+
-----END PGP SIGNATURE-----
--nextPart4046912.7uUuGbioyB--
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
On Tuesday 14 November 2006 17:32, Stefan Esser wrote:
> =A0 Application: Dotdeb PHP < 5.2.0 Rev 3
> =A0 =A0 =A0Severity: Calling PHP scripts with special crafted URLs
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0can result in arbitrary email header injec=
tion
> =A0 =A0 =A0 =A0 =A0Risk: Critical
> Vendor Status: Vendor has fixed this with Dotdeb PHP 5.2.0 rev 3
As far as I can see, the package diff for php4.4.4=20
http://packages.dotdeb.org/dists/stable/php4/source/php4_4.4.4-0.dotdeb.1.d=
iff.gz
contains the vulnerable patch as well.
I wasn't unable to find a security contact (or even A contact) on dotdeb's =
web=20
site, nor I could find a version control system from which i could abstract=
=20
easily the security patch in order to easily backport it myself.
As a dotdeb user i'm a bit disappointed, but i also know that's because i=20
didn't check when i chose dotdeb as my php4 backporter for sarge, so i have=
=20
very little to complain.
Anyway, will the maintainer provide updated php4 packages as well?
=46or those of you interested in upgrading today, here is a diff between th=
e=20
php4 mail patch and the new php5 mail patch: http://ca.pastebin.com/824455
=2D-=20
pub 1024D/8D2787EF 723C 7CA3 3C19 2ACE 6E20 9CC1 9956 EB3C 8D27 87EF
--nextPart4046912.7uUuGbioyB
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
iD8DBQBFWjJymVbrPI0nh+8RAq/CAJ0XsZwFYP9e9B95gAlwzwKPlL6a8QCcCdeJ
WoSH9NUENl3oksyLl8mrwXs=
=yug+
-----END PGP SIGNATURE-----
--nextPart4046912.7uUuGbioyB--