[ GLSA 201209-03 ] PHP: Multiple vulnerabilities

[GLSA]

Gentoo Linux Security Advisory

Title: PHP: Multiple vulnerabilities (GLSA 201209-03)
Severity: high
Exploitable: remote
Date: September 24, 2012
Bug(s): #384301, #396311, #396533, #399247, #399567, #399573, #401997, #410957, #414553, #421489, #427354, #429630
ID: 201209-03

Synopsis

Multiple vulnerabilities were found in PHP, the worst of which lead
to remote execution of arbitrary code.


Background

PHP is a widely-used general-purpose scripting language that is
especially suited for Web development and can be embedded into HTML.


Affected Packages

Package: dev-lang/php
Vulnerable: < 5.3.15
Vulnerable: < 5.4.5
Unaffected: >= 5.3.15
Unaffected: >= 5.4.5
Architectures: All supported architectures


Description

Multiple vulnerabilities have been discovered in PHP. Please review the
CVE identifiers referenced below for details.


Impact

A remote attacker could execute arbitrary code with the privileges of
the process, cause a Denial of Service condition, obtain sensitive
information, create arbitrary files, conduct directory traversal attacks,
bypass protection mechanisms, or perform further attacks with unspecified
impact.


Workaround

There is no known workaround at this time.

Resolution

All PHP users should upgrade to the latest version: