advisories/10456.adv

type: security
subject: Updated php packages fix security vulnerabilies
CVE:
 - CVE-2013-2110
 - CVE-2013-4635
src:
  3:
   core:
     - php-5.4.16-1.mga3
     - php-apc-3.1.14-7.1.mga3
     - php-gd-bundled-5.4.16-1.mga3
     - php-timezonedb-2013.3-1.mga3
description: |
  Heap based buffer overflow in quoted_printable_encode() in PHP before
  version 5.4.16 (CVE-2013-2110).

  Integer overflow in the SdnToJewish function in jewish.c in the Calendar
  component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows
  context-dependent attackers to cause a denial of service (application hang)
  via a large argument to the jdtojewish function. (CVE-2013-4635)
  
  This update provides PHP version 5.4.16 which fixes this as well as
  several other issues.
references:
 - https://bugs.mageia.org/show_bug.cgi?id=10456
 - http://www.php.net/ChangeLog-5.php
 - http://lwn.net/Vulnerabilities/559055/
ID: MGASA-2013-0172
1	boklm	28	type: security
2	claire	208	subject: Updated php packages fix security vulnerabilies
3	boklm	28	CVE:
4			- CVE-2013-2110
5	claire	208	- CVE-2013-4635
6	boklm	28	src:
7			3:
8			core:
9			- php-5.4.16-1.mga3
10			- php-apc-3.1.14-7.1.mga3
11			- php-gd-bundled-5.4.16-1.mga3
12			- php-timezonedb-2013.3-1.mga3
13			description: \|
14			Heap based buffer overflow in quoted_printable_encode() in PHP before
15			version 5.4.16 (CVE-2013-2110).
16
17	claire	208	Integer overflow in the SdnToJewish function in jewish.c in the Calendar
18			component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows
19			context-dependent attackers to cause a denial of service (application hang)
20			via a large argument to the jdtojewish function. (CVE-2013-4635)
21
22	boklm	28	This update provides PHP version 5.4.16 which fixes this as well as
23			several other issues.
24			references:
25			- https://bugs.mageia.org/show_bug.cgi?id=10456
26			- http://www.php.net/ChangeLog-5.php
27	claire	208	- http://lwn.net/Vulnerabilities/559055/
28	boklm	37	ID: MGASA-2013-0172