| Description: | Description:
The remote host is missing an update to php
announced via advisory MDKSA-2004:068.
Stefan Esser discovered a remotely exploitable vulnerability in PHP
where a remote attacker could trigger a memory_limit request
termination in places where an interruption is unsafe. This could be
used to execute arbitrary code.
As well, Stefan Esser also found a vulnerability in the handling of
allowed tags within PHP's strip_tags() function. This could lead to
a number of XSS issues on sites that rely on strip_tags()
however,
this only seems to affect the Internet Explorer and Safari browsers.
The updated packages have been patched to correct the problem and
all users are encouraged to upgrade immediately.
Affected versions: 10.0, 9.1, 9.2, Corporate Server 2.1,
Multi Network Firewall 8.2
Solution:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
https://secure1.securityspace.com/smysecure/catid.html?in=MDKSA-2004:068
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0594
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0595
http://security.e-matters.de/advisories/112004.html
http://security.e-matters.de/advisories/122004.html
Risk factor : High
CVSS Score:
6.8
|
