CVE-2008-5557: buffer overflow

Debian Bug report logs - #511493
CVE-2008-5557: buffer overflow

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Steffen Joeris <steffen.joeris@skolelinux.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2008-5557: buffer overflow

Date: Sun, 11 Jan 2009 10:30:20 -0500

Package: php5
Severity: grave
Tags: security, patch
Justification: user security hole

Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for php5.

CVE-2008-5557[0]:
| Heap-based buffer overflow in
| ext/mbstring/libmbfl/filters/mbfilter_htmlent.c in the mbstring
| extension in PHP 4.3.0 through 5.2.6 allows context-dependent
| attackers to execute arbitrary code via a crafted string containing an
| HTML entity, which is not properly handled during Unicode conversion,
| related to the (1) mb_convert_encoding, (2) mb_check_encoding, (3)
| mb_convert_variables, and (4) mb_parse_str functions.

There are some more information available in the php bugreport[1],
including the PoC which seems to work.

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

Cheers
Steffen

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5557
    http://security-tracker.debian.net/tracker/CVE-2008-5557
[1] http://bugs.php.net/bug.php?id=45722

Message #14 received at 511493-done@bugs.debian.org (full text, mbox, reply):

From: sean finney <seanius@debian.org>

To: 511493-done@bugs.debian.org

Subject: Re: [php-maint] Bug#511493: CVE-2008-5557: buffer overflow

Date: Tue, 13 Jan 2009 22:21:41 +0100

[Message part 1 (text/plain, inline)]

Version: 5.2.6.dfsg.1-2

fixed in unstable.  an upload was skipped so closing manually.

	sean

[signature.asc (application/pgp-signature, inline)]

Message #23 received at 511493-done@bugs.debian.org (full text, mbox, reply):

From: sean finney <seanius@debian.org>

To: 511493-done@bugs.debian.org, 511049-done@bugs.debian.org, 508989-done@bugs.debian.org

Subject: fixed in previous version but not recorded

Date: Sat, 28 Feb 2009 20:40:27 +0100

[Message part 1 (text/plain, inline)]

Version: 5.2.6.dfsg.1-1+lenny1

The following bugs are fixed in lenny, but were not recorded as such because
there was an unreleased version in between uploads which was not automatically
processed for Closes: lines.

[signature.asc (application/pgp-signature, inline)]

Message #32 received at 511493@bugs.debian.org (full text, mbox, reply):

From: Sean Finney <seanius@debian.org>

To: 511493@bugs.debian.org

Cc: ,control@bugs.debian.org

Subject: [debian/debian-etch] fix for CVE-2008-5557: Heap based overflow in mbstring extension

Date: Tue, 28 Apr 2009 18:00:43 +0000

tag 511493 pending
thanks

Date: Tue Apr 28 19:43:55 2009 +0200
Author: Sean Finney <seanius@debian.org>
Commit ID: abafc5330cede8260890b3083b739891bd029d62
Commit URL: http://git.debian.org/?p=pkg-php/php.git;a=commitdiff;h=abafc5330cede8260890b3083b739891bd029d62
Patch URL: http://git.debian.org/?p=pkg-php/php.git;a=commitdiff_plain;h=abafc5330cede8260890b3083b739891bd029d62

    fix for CVE-2008-5557: Heap based overflow in mbstring extension

    this was imported from the dapper 5.1.2-1ubuntu3.13 security update

    Closes: #511493
      

Send a report that this bug log contains spam.