Summary
The remote host is missing updates announced in
advisory GLSA 201001-03.
Solution
All PHP users should upgrade to the latest version. As PHP is statically linked against a vulnerable version of the c-client library when the imap or kolab USE flag is enabled (GLSA 200911-03), users should upgrade net-libs/c-client beforehand:
# emerge --sync
# emerge --ask --oneshot --verbose '>=net-libs/c-client-2007e' # emerge --ask --oneshot --verbose '>=dev-lang/php-5.2.12'
http://www.securityspace.com/smysecure/catid.html?in=GLSA%20201001-03 http://bugs.gentoo.org/show_bug.cgi?id=249875
http://bugs.gentoo.org/show_bug.cgi?id=255121
http://bugs.gentoo.org/show_bug.cgi?id=260576
http://bugs.gentoo.org/show_bug.cgi?id=261192
http://bugs.gentoo.org/show_bug.cgi?id=266125
http://bugs.gentoo.org/show_bug.cgi?id=274670
http://bugs.gentoo.org/show_bug.cgi?id=280602
http://bugs.gentoo.org/show_bug.cgi?id=285434
http://bugs.gentoo.org/show_bug.cgi?id=292132
http://bugs.gentoo.org/show_bug.cgi?id=293888
http://bugs.gentoo.org/show_bug.cgi?id=297369
http://bugs.gentoo.org/show_bug.cgi?id=297370
http://www.gentoo.org/security/en/glsa/glsa-200911-03.xml
Insight
Multiple vulnerabilities were found in PHP, the worst of which leading to the remote execution of arbitrary code.
Severity
Classification
-
CVSS Base Score: 10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
Related Vulnerabilities