diff -u php5-5.3.3/debian/changelog php5-5.3.3/debian/changelog
--- php5-5.3.3/debian/changelog
+++ php5-5.3.3/debian/changelog
@@ -1,3 +1,10 @@
+php5 (5.3.3-7+squeeze15) squeeze-security; urgency=high
+
+  * [CVE-2013-1635] Fixed external entity loading
+  * [CVE-2013-1643] Check if soap.wsdl_cache_dir confirms to open_basedir
+
+ -- Ondřej Surý <ondrej@debian.org>  Mon, 04 Mar 2013 13:34:39 +0100
+
 php5 (5.3.3-7+squeeze14) squeeze-security; urgency=high
 
   * CVE-2012-2688: potential overflow in _php_stream_scandir
diff -u php5-5.3.3/debian/patches/series php5-5.3.3/debian/patches/series
--- php5-5.3.3/debian/patches/series
+++ php5-5.3.3/debian/patches/series
@@ -128,0 +129,2 @@
+CVE-2013-1635.patch
+CVE-2013-1643.patch
only in patch2:
unchanged:
--- php5-5.3.3.orig/debian/patches/CVE-2013-1635.patch
+++ php5-5.3.3/debian/patches/CVE-2013-1635.patch
@@ -0,0 +1,48 @@
+--- a/ext/soap/soap.c
++++ b/ext/soap/soap.c
+@@ -572,10 +572,44 @@ ZEND_INI_MH(OnUpdateCacheMode)
+ 	return SUCCESS;
+ }
+ 
++static PHP_INI_MH(OnUpdateCacheDir)
++{
++	/* Only do the safemode/open_basedir check at runtime */
++	if (stage == PHP_INI_STAGE_RUNTIME || stage == PHP_INI_STAGE_HTACCESS) {
++		char *p;
++
++		if (memchr(new_value, '\0', new_value_length) != NULL) {
++			return FAILURE;
++		}
++
++		/* we do not use zend_memrchr() since path can contain ; itself */
++		if ((p = strchr(new_value, ';'))) {
++			char *p2;
++			p++;
++			if ((p2 = strchr(p, ';'))) {
++				p = p2 + 1;
++			}
++		} else {
++			p = new_value;
++		}
++
++		if (PG(safe_mode) && *p && (!php_checkuid(p, NULL, CHECKUID_CHECK_FILE_AND_DIR))) {
++			return FAILURE;
++		}
++
++		if (PG(open_basedir) && *p && php_check_open_basedir(p TSRMLS_CC)) {
++			return FAILURE;
++		}
++	}
++
++	OnUpdateString(entry, new_value, new_value_length, mh_arg1, mh_arg2, mh_arg3, stage TSRMLS_CC);
++	return SUCCESS;
++}
++
+ PHP_INI_BEGIN()
+ STD_PHP_INI_ENTRY("soap.wsdl_cache_enabled",     "1", PHP_INI_ALL, OnUpdateCacheEnabled,
+                   cache_enabled, zend_soap_globals, soap_globals)
+-STD_PHP_INI_ENTRY("soap.wsdl_cache_dir",         "/tmp", PHP_INI_ALL, OnUpdateString,
++STD_PHP_INI_ENTRY("soap.wsdl_cache_dir",         "/tmp", PHP_INI_ALL, OnUpdateCacheDir,
+                   cache_dir, zend_soap_globals, soap_globals)
+ STD_PHP_INI_ENTRY("soap.wsdl_cache_ttl",         "86400", PHP_INI_ALL, OnUpdateLong,
+                   cache_ttl, zend_soap_globals, soap_globals)
only in patch2:
unchanged:
--- php5-5.3.3.orig/debian/patches/CVE-2013-1643.patch
+++ php5-5.3.3/debian/patches/CVE-2013-1643.patch
@@ -0,0 +1,135 @@
+--- a/ext/libxml/libxml.c
++++ b/ext/libxml/libxml.c
+@@ -261,6 +261,7 @@ static PHP_GINIT_FUNCTION(libxml)
+ 	libxml_globals->stream_context = NULL;
+ 	libxml_globals->error_buffer.c = NULL;
+ 	libxml_globals->error_list = NULL;
++	libxml_globals->entity_loader_disabled = 0;
+ }
+ 
+ /* Channel libxml file io layer through the PHP streams subsystem.
+@@ -350,16 +351,15 @@ static int php_libxml_streams_IO_close(v
+ }
+ 
+ static xmlParserInputBufferPtr
+-php_libxml_input_buffer_noload(const char *URI, xmlCharEncoding enc)
+-{
+-	return NULL;
+-}
+-
+-static xmlParserInputBufferPtr
+ php_libxml_input_buffer_create_filename(const char *URI, xmlCharEncoding enc)
+ {
+ 	xmlParserInputBufferPtr ret;
+ 	void *context = NULL;
++	TSRMLS_FETCH();
++
++	if (LIBXML(entity_loader_disabled)) {
++		return NULL;
++	}
+ 
+ 	if (URI == NULL)
+ 		return(NULL);
+@@ -835,28 +835,25 @@ static PHP_FUNCTION(libxml_clear_errors)
+ }
+ /* }}} */
+ 
++PHP_LIBXML_API zend_bool php_libxml_disable_entity_loader(zend_bool disable TSRMLS_DC)
++{
++	zend_bool old = LIBXML(entity_loader_disabled);
++
++	LIBXML(entity_loader_disabled) = disable;
++	return old;
++}
++
+ /* {{{ proto bool libxml_disable_entity_loader([boolean disable]) 
+    Disable/Enable ability to load external entities */
+ static PHP_FUNCTION(libxml_disable_entity_loader)
+ {
+ 	zend_bool disable = 1;
+-	xmlParserInputBufferCreateFilenameFunc old;
+ 
+ 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|b", &disable) == FAILURE) {
+ 		return;
+ 	}
+ 
+-	if (disable == 0) {
+-		old = xmlParserInputBufferCreateFilenameDefault(php_libxml_input_buffer_create_filename);
+-	} else {
+-		old = xmlParserInputBufferCreateFilenameDefault(php_libxml_input_buffer_noload);
+-	}
+-
+-	if (old == php_libxml_input_buffer_noload) {
+-		RETURN_TRUE;
+-	}
+-
+-	RETURN_FALSE;
++	RETURN_BOOL(php_libxml_disable_entity_loader(disable TSRMLS_CC));
+ }
+ /* }}} */
+ 
+--- a/ext/libxml/php_libxml.h
++++ b/ext/libxml/php_libxml.h
+@@ -43,6 +43,7 @@ ZEND_BEGIN_MODULE_GLOBALS(libxml)
+ 	zval *stream_context;
+ 	smart_str error_buffer;
+ 	zend_llist *error_list;
++	zend_bool entity_loader_disabled;
+ ZEND_END_MODULE_GLOBALS(libxml)
+ 
+ typedef struct _libxml_doc_props {
+@@ -93,6 +94,7 @@ PHP_LIBXML_API void php_libxml_ctx_error
+ PHP_LIBXML_API int php_libxml_xmlCheckUTF8(const unsigned char *s);
+ PHP_LIBXML_API zval *php_libxml_switch_context(zval *context TSRMLS_DC);
+ PHP_LIBXML_API void php_libxml_issue_error(int level, const char *msg TSRMLS_DC);
++PHP_LIBXML_API zend_bool php_libxml_disable_entity_loader(zend_bool disable TSRMLS_DC);
+ 
+ /* Init/shutdown functions*/
+ PHP_LIBXML_API void php_libxml_initialize(void);
+--- a/ext/soap/php_xml.c
++++ b/ext/soap/php_xml.c
+@@ -20,6 +20,7 @@
+ /* $Id: php_xml.c 293036 2010-01-03 09:23:27Z sebastian $ */
+ 
+ #include "php_soap.h"
++#include "ext/libxml/php_libxml.h"
+ #include "libxml/parser.h"
+ #include "libxml/parserInternals.h"
+ 
+@@ -91,13 +92,17 @@ xmlDocPtr soap_xmlParseFile(const char *
+ 	ctxt = xmlCreateFileParserCtxt(filename);
+ 	PG(allow_url_fopen) = old_allow_url_fopen;
+ 	if (ctxt) {
++		zend_bool old;
++
+ 		ctxt->keepBlanks = 0;
+ 		ctxt->sax->ignorableWhitespace = soap_ignorableWhitespace;
+ 		ctxt->sax->comment = soap_Comment;
+ 		ctxt->sax->warning = NULL;
+ 		ctxt->sax->error = NULL;
+ 		/*ctxt->sax->fatalError = NULL;*/
++		old = php_libxml_disable_entity_loader(1);
+ 		xmlParseDocument(ctxt);
++		php_libxml_disable_entity_loader(old);
+ 		if (ctxt->wellFormed) {
+ 			ret = ctxt->myDoc;
+ 			if (ret->URL == NULL && ctxt->directory != NULL) {
+@@ -133,6 +138,8 @@ xmlDocPtr soap_xmlParseMemory(const void
+ */
+ 	ctxt = xmlCreateMemoryParserCtxt(buf, buf_size);
+ 	if (ctxt) {
++		zend_bool old;
++
+ 		ctxt->sax->ignorableWhitespace = soap_ignorableWhitespace;
+ 		ctxt->sax->comment = soap_Comment;
+ 		ctxt->sax->warning = NULL;
+@@ -141,7 +148,9 @@ xmlDocPtr soap_xmlParseMemory(const void
+ #if LIBXML_VERSION >= 20703
+ 		ctxt->options |= XML_PARSE_HUGE;
+ #endif
++		old = php_libxml_disable_entity_loader(1);
+ 		xmlParseDocument(ctxt);
++		php_libxml_disable_entity_loader(old);
+ 		if (ctxt->wellFormed) {
+ 			ret = ctxt->myDoc;
+ 			if (ret->URL == NULL && ctxt->directory != NULL) {