USN-99-1 fixed a safe mode bypass which allowed malicious PHP scripts to circumvent path restrictions by creating a specially crafted directory whose length exceeded the capacity of the realpath() function (CAN-2004-1064). However, this caused severe regressions, some applications like SquirrelMail and Gallery did not work any more, and the package ‘php4-pear’ was empty. The current version repairs this.
In addition this update fixes a crash of the PHP interpreter if curl_init() was called with a non-string argument. Please note that this is not security relevant since this condition usually cannot be triggered externally.
24 March 2005
A security issue affects these releases of Ubuntu and its derivatives:
USN-99-1 fixed a safe mode bypass which allowed malicious PHP scripts to circumvent path restrictions by creating a specially crafted directory whose length exceeded the capacity of the realpath() function (CAN-2004-1064). However, this caused severe regressions, some applications like SquirrelMail and Gallery did not work any more, and the package ‘php4-pear’ was empty. The current version repairs this.
In addition this update fixes a crash of the PHP interpreter if curl_init() was called with a non-string argument. Please note that this is not security relevant since this condition usually cannot be triggered externally.
The problem can be corrected by updating your system to the following package versions:
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
Vulmon