php5: CVE-2012-3450: pdo array overread/crash

Debian Bug report logs - #683694
php5: CVE-2012-3450: pdo array overread/crash

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Henri Salo <henri@nerv.fi>

To: submit@bugs.debian.org

Cc: pkg-php-maint@lists.alioth.debian.org

Subject: php5: CVE-2012-3450: pdo array overread/crash

Date: Fri, 3 Aug 2012 00:29:25 +0300

Subject: CVE-2012-3450: php5 pdo array overread/crash
Package: php5
Severity: important
Tags: security, fixed-upstream

Denial of service vulnerability has been found and fixed in PHP, which might affect Debian packages too.

Original report: http://seclists.org/bugtraq/2012/Jun/60 (Discovered by 0x721427D8 via BeyondSecurity - SecuriTeam Secure Disclosure)
Upstream bug-report: https://bugs.php.net/bug.php?id=61755 with a test-case
Patch: https://bugs.php.net/patch-display.php?bug_id=61755&patch=bug61755.diff&revision=latest
Currently in Debian security tracker as undetermined: http://lists.alioth.debian.org/pipermail/secure-testing-commits/2012-August/021045.html

As I do not currently have time I request package maintainers to check if Debian packages are affected. I can also do proper testing and add affected versions to this bug-report after few days when I have more free time.

Best regards,
Henri Salo

Send a report that this bug log contains spam.