For Secure Development, PHP Updated

KAJICHO KIVULI · 2014-05-05T19:18:22+00:00

The maintainers of PHP have released two new versions of the scripting language that fix a number of bugs, to protect PHP developers from bugs, including the OpenSSL Heartbleed vulnerability. Versions 5.4.28 and 5.5.12 both contain that important patch, as well as fixes for more than a dozen other vulnerabilities. The vulnerability in OpenSSL is Heartbleed which is a memory leak that attackers can exploit on vulnerable servers to get access to 64KB of memory per request. Developers and site owners have been scrambling to fix the vulnerability for the last few weeks. The repair for the Heartbleed flaw is in both PHP 5.4.28 and 5.5.12. Both versions also include a slew of other bug fixes, one of which is for CVE-2014-0185, a privilege escalation flaw. The bug could allow an attacker to run arbitrary code in some situations. Both default config and compiled-in defaults of sapi/fpm lead to configurations which easily allow any user with rights to connect to a UNIX socket to run arbitrary code with the permissions of the fpm user, a description of the bug says. Users of either version of PHP are encouraged to update to the fixed packages as soon as possible to protect themselves against potential attacks.

Thread starter KAJICHO KIVULI
Start date May 5, 2014

KAJICHO KIVULI

JamiiForums uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.

Accept Learn more…

Back

Top Bottom

Forums

New posts

For Secure Development, PHP Updated

KAJICHO KIVULI

JF-Expert Member

Our Community

Regional Communities