USN-99-2: Fixed php4 packages for USN-99-1

Releases

• Ubuntu 4.10

Details

USN-99-1 fixed a safe mode bypass which allowed malicious PHP scripts
to circumvent path restrictions by creating a specially crafted
directory whose length exceeded the capacity of the realpath()
function (CAN-2004-1064). However, this caused severe regressions,
some applications like SquirrelMail and Gallery did not work any
more, and the package 'php4-pear' was empty. The current version
repairs this.

In addition this update fixes a crash of the PHP interpreter if
curl_init() was called with a non-string argument. Please note that
this is not security relevant since this condition usually cannot be
triggered externally.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 4.10

• libapache2-mod-php4 -
• php4-cgi -

In general, a standard system update will make all the necessary changes.

References

• CVE-2004-1064

Related notices

• USN-99-1: libapache2-mod-php4, php4-cgi