Re: php vulnerability
> I checked lwn.net and found that redhat, suse, and mandrake have made
> available security patches. I am wondering, if Debian is not vulnerable, if
> the patch is very closed to be release, or if we have to enable the described
> work arounds.
Debian is reportedly vulnerable i've heard. (the security team is in
possession of code to exploit the vulnerability as well)
A fixed version of php4 is already in the unstable distribution. Users
of testing should install that one.
A proper fix for "stable" is underway; but it's more difficult to fix
this properly because of the age of the "stable" distribution I think.
Debian is getting slower with security updates due to the number of
different architectures it has to support. Most other distributions
release the fix for i386 immedeately; Debian usually compiles the
updates for all arch's and then releases the advisory (so it can contain
checksums for all architectures); building on architectures like mips
takes more time then on plain i386.
You should disable file uploads in the config file until the proper fix
is relased for stable. I'm sure the security team is preparing the fix
and advisory right now.
Greetings,
Erich
Reply to: