[CVE-2012-1172] PHP 5.3.x Corrupted $_FILES indices lead to security concern

Related Vulnerabilities: CVE-2012-1172  

Debian Bug report logs - #663760
[CVE-2012-1172] PHP 5.3.x Corrupted $_FILES indices lead to security concern

version graph

Reported by: Luciano Bello <luciano@debian.org>

Date: Tue, 13 Mar 2012 21:57:01 UTC

Severity: important

Tags: patch, security

Fixed in version php5/5.4.0-1

Done: "Thijs Kinkhorst" <thijs@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Debian PHP Maintainers <pkg-php-maint@lists.alioth.debian.org>:
Bug#663760; Package php5. (Tue, 13 Mar 2012 21:57:04 GMT) (full text, mbox, link).


Acknowledgement sent to Luciano Bello <luciano@debian.org>:
New Bug report received and forwarded. Copy sent to Debian PHP Maintainers <pkg-php-maint@lists.alioth.debian.org>. (Tue, 13 Mar 2012 21:57:05 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Luciano Bello <luciano@debian.org>
To: submit@bugs.debian.org
Subject: [CVE-2012-1172] PHP 5.3.x Corrupted $_FILES indices lead to security concern
Date: Tue, 13 Mar 2012 22:54:37 +0100
[Message part 1 (text/plain, inline)]
Package: php5
Severity: important
Tags: security patch

The following vulnerability had been reported against php5: 
http://www.openwall.com/lists/oss-security/2012/03/08/4

The patch can be found in the report.

Please use CVE-2012-1172 for this issue.

Cheers,
/luciano
[signature.asc (application/pgp-signature, inline)]

Marked as fixed in versions php5/5.4.0-1. Request was from "Thijs Kinkhorst" <thijs@debian.org> to control@bugs.debian.org. (Wed, 04 Apr 2012 08:36:46 GMT) (full text, mbox, link).


Marked Bug as done Request was from "Thijs Kinkhorst" <thijs@debian.org> to control@bugs.debian.org. (Wed, 04 Apr 2012 08:36:46 GMT) (full text, mbox, link).


Notification sent to Luciano Bello <luciano@debian.org>:
Bug acknowledged by developer. (Wed, 04 Apr 2012 08:36:48 GMT) (full text, mbox, link).


Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Thu, 03 May 2012 07:39:34 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 19:13:47 2019; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.