PHP 5.3.x < 5.3.14 / 5.4.x < 5.4.4 Multiple Vulnerabilities

Versions of PHP 5.3.x prior to 5.3.14, or 5.4.x prior to 5.4.4 are affected by the following vulnerabilities :

• An integer overflow error exists in the function ‘phar_parse_tarfile’ in the file ‘ext/phar/tar.c’. This error can lead to a heap-based buffer overflow when handling a maliciously crafted TAR file. Arbitrary code execution is possible due to this error. (CVE-2012-2386)
• A weakness exists in the ‘crypt’ function related to the DES implementation that can allow brute-force attacks. (CVE-2012-2143)
• Several design errors exist involving the incorrect parsing of PHP PDO prepared statements could lead to disclosure of sensitive information or denial of service. (CVE-2012-3450)
• A variable initialization error exists in the file ‘ext/openssl/openssl.c’ that can allow process memory contents to be disclosed when input data is of length zero. (CVE-2012-6113)