Re: Comments on PHP security
| From: | Stefan Esser | Date: | Thu, 11 Jan 2007 16:19:30 +0000 |
| Subject: | Re: Comments on PHP security | ||
| References: | 1 2 3 4 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-27364@lists.php.net to get a copy of this message | ||
> For your information, zip is not enabled by default. If you have a
> bug/issue about the specific zip:// URL, please let me know. Ilia and
> Tony already fixed some paths fixes and the fixes are available in
> zip-1.8.4. They will be in 5.2.1.
For your information Pierre: Security Bugs in PHP are usually found by
me. So guess twice WHO told security@php.net that there are
bufferoverflows in zip:// URLs and WHY there have been bugfixes to ext/zip.
BTW: Last time I checked, popular packages like dotdeb PHP activate
ext/zip by default...
And yes... Also prepare for the ***more than 30 vulnerabilities*** I
disclosed to security@php.net during the last 3 weeks.
Have fun...
Stefan