« previous next »
Pages: [1]

Author Topic: PHP Critical Security Fix  (Read 355 times)

cms07

  • Full Member
  • ***
  • Posts: 115
    • View Profile
    • Blog
PHP Critical Security Fix
« on: February 03, 2012, 11:28:45 PM »
http://www.php.net/archive/2012.php#id2012-02-02-1
Quote
The PHP development team would like to announce the immediate availability of PHP 5.3.10. This release delivers a critical security fix.

Security Fixes in PHP 5.3.10:

Fixed arbitrary remote code execution vulnerability reported by Stefan Esser, CVE-2012-0830.
All users are strongly encouraged to upgrade to PHP 5.3.10.

Is this an issue?
Logged
Intel Core 2 Duo CPU T5470 @ 1.60GHz
KDE 4 on Arch Linux.

zzbomb

  • Hero Member
  • *****
  • Posts: 963
  • The awesome server admin
    • View Profile
    • ChemicalServers
Re: PHP Critical Security Fix
« Reply #1 on: February 03, 2012, 11:31:52 PM »
Server does not run PHP 5.3.*
So no.

PHP 5.3.* is an unstable release. PHP does releases where odd numbers are unstable and even numbers are stable. So I keep the 5.2.* branch up to date, dont touch the 5.3.* and will eventually upgrade when 5.4.* is officially released and stable.

Not to mention 5.2.* has highest level of compatibility with things. Only a few odd scripts like the latest version of moodle require 5.3.*
« Last Edit: February 03, 2012, 11:33:43 PM by zzbomb »
Logged

cms07

  • Full Member
  • ***
  • Posts: 115
    • View Profile
    • Blog
Re: PHP Critical Security Fix
« Reply #2 on: February 03, 2012, 11:47:27 PM »
Quote from: zzbomb on February 03, 2012, 11:31:52 PM
Server does not run PHP 5.3.*
So no.

PHP 5.3.* is an unstable release. PHP does releases where odd numbers are unstable and even numbers are stable. So I keep the 5.2.* branch up to date, dont touch the 5.3.* and will eventually upgrade when 5.4.* is officially released and stable.

Not to mention 5.2.* has highest level of compatibility with things. Only a few odd scripts like the latest version of moodle require 5.3.*
Thanks. I do not stay up with or really use PHP anymore.
Logged
Intel Core 2 Duo CPU T5470 @ 1.60GHz
KDE 4 on Arch Linux.

Confuser

  • Hero Member
  • *****
  • Posts: 506
    • View Profile
Re: PHP Critical Security Fix
« Reply #3 on: February 04, 2012, 07:17:31 AM »
That vulnerability was caused by a fix to a previous vulnerability in which a server can be overloaded as there is no limit on the amount of $_REQUST data someone can send ;)
Logged

zzbomb

  • Hero Member
  • *****
  • Posts: 963
  • The awesome server admin
    • View Profile
    • ChemicalServers
Re: PHP Critical Security Fix
« Reply #4 on: February 04, 2012, 08:27:14 PM »
Quote from: Confuser on February 04, 2012, 07:17:31 AM
That vulnerability was caused by a fix to a previous vulnerability in which a server can be overloaded as there is no limit on the amount of $_REQUST data someone can send ;)
Ah. That.. Yea I heard something about that when it was found. Quite the commotion.
Logged

Primefalcon

  • Hero Member
  • *****
  • Posts: 2168
  • https://launchpad.net/~primefalcon
    • View Profile
    • Prime's Tech Talk
Re: PHP Critical Security Fix
« Reply #5 on: February 04, 2012, 08:38:49 PM »
Quote from: Emmanuel Goldstein on February 03, 2012, 11:47:27 PM
Quote from: zzbomb on February 03, 2012, 11:31:52 PM
Server does not run PHP 5.3.*
So no.

PHP 5.3.* is an unstable release. PHP does releases where odd numbers are unstable and even numbers are stable. So I keep the 5.2.* branch up to date, dont touch the 5.3.* and will eventually upgrade when 5.4.* is officially released and stable.

Not to mention 5.2.* has highest level of compatibility with things. Only a few odd scripts like the latest version of moodle require 5.3.*
Thanks. I do not stay up with or really use PHP anymore.
What do you use then for server side programming?
Logged
Get 2.25G of space on Dropbox by CLICKING HERE, Rather than 2G otherwise. Sync files between multiple computers, Web and even share folders with your friends!

cms07

  • Full Member
  • ***
  • Posts: 115
    • View Profile
    • Blog
Re: PHP Critical Security Fix
« Reply #6 on: February 04, 2012, 08:57:51 PM »
Quote from: Primefalcon on February 04, 2012, 08:38:49 PM
Quote from: Emmanuel Goldstein on February 03, 2012, 11:47:27 PM
Quote from: zzbomb on February 03, 2012, 11:31:52 PM
Server does not run PHP 5.3.*
So no.

PHP 5.3.* is an unstable release. PHP does releases where odd numbers are unstable and even numbers are stable. So I keep the 5.2.* branch up to date, dont touch the 5.3.* and will eventually upgrade when 5.4.* is officially released and stable.

Not to mention 5.2.* has highest level of compatibility with things. Only a few odd scripts like the latest version of moodle require 5.3.*
Thanks. I do not stay up with or really use PHP anymore.
What do you use then for server side programming?
I don't do it often, now.
Logged
Intel Core 2 Duo CPU T5470 @ 1.60GHz
KDE 4 on Arch Linux.

Pinako

  • Hero Member
  • *****
  • Posts: 1263
    • View Profile
    • inportb
Re: PHP Critical Security Fix
« Reply #7 on: February 04, 2012, 09:57:23 PM »
... and, updated.

For server-side programming, I prefer Python. I run PHP for Wordpress.
Logged

cms07

  • Full Member
  • ***
  • Posts: 115
    • View Profile
    • Blog
Re: PHP Critical Security Fix
« Reply #8 on: February 05, 2012, 12:34:30 AM »
Quote from: Pinako on February 04, 2012, 09:57:23 PM
... and, updated.

For server-side programming, I prefer Python. I run PHP for Wordpress.
I've always been turned off by the seemingly fragmented users (2 and 3). Many libraries are 2.
Logged
Intel Core 2 Duo CPU T5470 @ 1.60GHz
KDE 4 on Arch Linux.

Primefalcon

  • Hero Member
  • *****
  • Posts: 2168
  • https://launchpad.net/~primefalcon
    • View Profile
    • Prime's Tech Talk
Re: PHP Critical Security Fix
« Reply #9 on: February 05, 2012, 01:24:35 AM »
Quote from: Emmanuel Goldstein on February 05, 2012, 12:34:30 AM
Quote from: Pinako on February 04, 2012, 09:57:23 PM
... and, updated.

For server-side programming, I prefer Python. I run PHP for Wordpress.
I've always been turned off by the seemingly fragmented users (2 and 3). Many libraries are 2.
Which is why if compatibility is a concern your recommended to stick with 2 atm..... And I agree Inp Python is a kick arse langauge.... and is my preferred scripting language on the desktop.... however on web servers I still prefer PHP, it just feels more suited to that role to me without any extra frameworks/toolkits
Logged
Get 2.25G of space on Dropbox by CLICKING HERE, Rather than 2G otherwise. Sync files between multiple computers, Web and even share folders with your friends!
Pages: [1]
« previous next »