Re: PHP5 in Wheezy vulnerable to CVE-2013-2110?
On Thu, June 20, 2013 09:08, jaroslav@thinline.cz wrote:
> Can someone please confirm that the Wheezy package is really not
> vulnerable? I tried to use the test code from PHP (attached below) on
> multiple PHP versions, but it doesn't cause segfaults (as it's supposed
> to) on any of those I tried (Not even on PHP 5.3.23, which is supposed
> to be vulnerable.)
The bug was originally introduced in PHP upstream with this commit:
http://git.php.net/?p=php-src.git;a=commitdiff;h=18bb426587d62f93c54c40bf8535eb8416603629
As you can verify, that code is not present in Debian Wheezy, making
Wheezy not vulnerable to this bug.
Cheers,
Thijs
Reply to: