[security-alerts] FW: [SA19927] PHP Multiple Unspecified Vulnerabilities

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> 
> TITLE:
> PHP Multiple Unspecified Vulnerabilities
> 
> SECUNIA ADVISORY ID:
> SA19927
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/19927/
> 
> CRITICAL:
> Moderately critical
> 
> IMPACT:
> Unknown
> 
> WHERE:
> From remote
> 
> SOFTWARE:
> PHP 5.1.x
> http://secunia.com/product/6796/
> 
> DESCRIPTION:
> Some unspecified vulnerabilities with unknown impacts have been
> reported in PHP.
> 
> 1) An offset/length parameter validation error exists in the
> "substr_compare()" function.
> 
> 2) An unspecified error exists in the handling of certain characters
> in session names.
> 
> 3) An unspecified error in the session extension can be exploited to
> cause a heap corruption.
> 
> 4) The "unset()" function may not unset variables properly in some
> situations.
> 
> Many other issues, where some may be security related, have also been
> reported.
> 
> SOLUTION:
> Update to version 5.1.3.
> http://www.php.net/downloads.php
> 
> PROVIDED AND/OR DISCOVERED BY:
> Reported by the vendor.
> 
> ORIGINAL ADVISORY:
> PHP Group:
> http://www.php.net/release_5_1_3.php
>