From: seanius at debian dot org Operating system: source code PHP version: 5.2.2 PHP Bug Type: SQLite related Bug description: better fix for CVE-2007-1887-1888/MOPB-41
Description: ------------ from what i understand, your fix for the above mentioned vulnerabilities was to patch the bundled sqlite libraries to handle certain parameters that might be null pointers. however, for distributions where php is built against external sqlite packages, this has no effect and the resulting packages are still vulnerable unless the sqlite packages are independantly patched. in the debian php packages, we've patched the php_sqlite module to check for the null pointers outside of the call to the sqlite functions, thus not requiring a patch or change in the behaviour of the sqlite libraries. anyway, if you want to continue keeping a patched bundled version of sqlite, that's fine, but i thought i'd share this. -- Edit bug report at http://bugs.php.net/?id=41285&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=41285&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=41285&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=41285&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=41285&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=41285&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=41285&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=41285&r=needscript Try newer version: http://bugs.php.net/fix.php?id=41285&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=41285&r=support Expected behavior: http://bugs.php.net/fix.php?id=41285&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=41285&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=41285&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=41285&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=41285&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=41285&r=dst IIS Stability: http://bugs.php.net/fix.php?id=41285&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=41285&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=41285&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=41285&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=41285&r=mysqlcfg
