[slackware-security] php

New php packages are available for Slackware 10.2 and 11.0 to improve the
stability and security of PHP. Quite a few bugs were fixed – please
see http://www.php.net for a detailed list. All sites that use PHP are
encouraged to upgrade. Please note that we haven’t tested all PHP
applications for backwards compatibility with this new upgrade, so you
should have the old package on hand just in case.

Both PHP 4.4.5 and PHP 5.2.1 updates have been provided.

Some of these issues have been assigned CVE numbers and may be referenced
in the Common Vulnerabilities and Exposures (CVE) database:

https://vulners.com/cve/CVE-2007-0906
https://vulners.com/cve/CVE-2007-0907
https://vulners.com/cve/CVE-2007-0908
https://vulners.com/cve/CVE-2007-0909
https://vulners.com/cve/CVE-2007-0910
https://vulners.com/cve/CVE-2007-0988

Here are the details from the Slackware 11.0 ChangeLog:

patches/packages/php-4.4.5-i486-1_slack11.0.tgz:
Upgraded to php-4.4.5 which improves stability and security.
For complete details, see http://www.php.net.
For imformation about some of the security fixes, see:
https://vulners.com/cve/CVE-2007-0906
https://vulners.com/cve/CVE-2007-0907
https://vulners.com/cve/CVE-2007-0908
https://vulners.com/cve/CVE-2007-0909
https://vulners.com/cve/CVE-2007-0910
https://vulners.com/cve/CVE-2007-0988
(* Security fix )
extra/php5/php-5.2.1-i486-1_slack11.0.tgz:
Upgraded to php-5.2.1 which improves stability and security.
For imformation about some of the security fixes, see:
https://vulners.com/cve/CVE-2007-0906
https://vulners.com/cve/CVE-2007-0907
https://vulners.com/cve/CVE-2007-0908
https://vulners.com/cve/CVE-2007-0909
https://vulners.com/cve/CVE-2007-0910
https://vulners.com/cve/CVE-2007-0988
( Security fix *)

Where to find the new packages:

HINT: Getting slow download speeds from ftp.slackware.com?
Give slackware.osuosl.org a try. This is another primary FTP site
for Slackware that can be considerably faster than downloading
from ftp.slackware.com.

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating additional FTP and rsync hosting
to the Slackware project! :-)

Also see the “Get Slack” section on http://slackware.com for
additional mirror sites near you.

Updated packages for Slackware 10.2:
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/php-4.4.5-i486-1_slack10.2.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/testing/packages/php-5.2.1/php-5.2.1-i486-1_slack10.2.tgz

Updated packages for Slackware 11.0:
ftp://ftp.slackware.com/pub/slackware/slackware-11.0/patches/packages/php-4.4.5-i486-1_slack11.0.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-11.0/extra/php5/php-5.2.1-i486-1_slack11.0.tgz

MD5 signatures:

Slackware 10.2 packages:
9910a0b1e46d10583b6d2f6588e13457 php-4.4.5-i486-1_slack10.2.tgz
6f4eb9e2bb286cb33bf8f450e458025e php-5.2.1-i486-1_slack10.2.tgz

Slackware 11.0 packages:
4e312abf50feeedfe50a1fcddbd4cb2a php-4.4.5-i486-1_slack11.0.tgz
be96edf4afb6b554b22df5f30a8d2b9b php-5.2.1-i486-1_slack11.0.tgz

Installation instructions:

First, stop apache:
> apachectl stop

Next, upgrade to the new PHP package:
> upgradepkg php-4.4.5-i486-1_slack11.0.tgz

Finally, restart apache:
> apachectl start (or: apachectl startssl)