Re: php4-gd

Arek Czereszewski wrote:
Hello,

I have on some web servers php4-gd port installed
and I am totally confused.
Portaudit says

Affected package: php4-gd-4.4.9
Type of problem: gd -- '_gdGetColors' remote buffer overflow
vulnerability.
Reference: <http://portaudit.FreeBSD.org/4e8344a3-ca52-11de-8ee8-00215c6a37bb.html>

On this site is info about: 5.2.11 and 5.3.0

On Securityfocus is info also about 4.4.9
but on cve.mitre.org is not.

Any idea where is the true?
Are my servers with php4-gd are secure or not?

This is a bug in the underlying gd library rather than in PHP itself. There
are fixes to two related ports: if you've updated graphics/gd to the latest
version (gd-2.0.35_2,1), and built the latest port revision of the php5-gd
module (which is php5-gd-5.2.11_2) then those should have been secured.

However, the PHP4 version of the gd module is still at version php4-gd-4.4.9, and doesn't seem to have been patched -- there is no patch
for CVE-2009-3546 in the php4 sources -- so it seems you are still vulnerable
when using PHP4. This is to be expected: the PHP project is deprecating PHP4
and putting all their effort in to developing PHP5 instead. Patches may
be forthcoming eventually, but who knows when?

Basically, if you're running PHP4 on a public site then you should be making
plans to upgrade to PHP5 ASAP.

Cheers,

Matthew

--
Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard
Flat 3
PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate
Kent, CT11 9PW

Attachment: signature.asc
Description: OpenPGP digital signature

Relevant Pages

  • Re: php4-gd
    ... I have on some web servers php4-gd port installed ... vulnerability. ... the PHP4 version of the gd module is still at version ...
    (freebsd-questions)
  • ports and php versions
    ... Presumably it wouldn't be a good idea to pull in all the php4 stuff ... along with the wiki port - so I guess I'll have to build it myself from ... Please use the corrected version of the address below for replies. ...
    (comp.unix.bsd.freebsd.misc)
  • Re: [PHP] Payflow and Php5 on FreeBSD
    ... going back to php4 is not an option, ... source-install of php5. ... copy it in to the php5 extensions area on the original box, ... a php5-pfpro port in the official FreeBSD ports collection: ...
    (php.general)
  • make package
    ... As I've seen some websites break afer they'd been upgraded from PHP ... I was thinking about doing a 'make package' beforehand for each PHP4 ... port that I currently have installed. ...
    (freebsd-questions)