Your message dated Tue, 18 Apr 2023 13:56:26 +0200
with message-id <[email protected]>
and subject line php5 has been superseded by php7
has caused the Debian Bug report #869893,
regarding URL Parsing Problem
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
869893: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869893
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: php5
Version: 5.4.45-0+deb7u9
I found a bug in last update in url parsing when I will use fopen with sftp
connection. Here a little sample script which works before the update and now
ends with fopen(ssh2.sftp://Resource id #5//some remote file): failed to open
stream:
<?php
$server = 'example.server';
$user = 'example_user';
$pass = 'example_pass';
$file = 'some remote file';
$connection = ssh2_connect($server, 22);
ssh2_auth_password($connection, $user, $pass);
$sftp = ssh2_sftp($connection);
$path = sprintf('%s%s',
ssh2_sftp_realpath($sftp, '.'),
$file);
$sftp_path = sprintf(
'ssh2.sftp://%s/%s',
$sftp, $path
);
$stat = ssh2_sftp_stat($sftp, $path);
$stream = fopen($sftp_path, 'r');
$size = $stat['size'];
$contents = '';
$read = 0;
$len = $size;
while ($read < $len && ($buf = fread($stream, $len - $read))) {
$read += strlen($buf);
$contents .= $buf;
}
file_put_contents('./test_down.pdf', $contents);
fclose($stream);
I think this error happens because of the following security bugfix
* CVE-2016-10397:
Incorrect handling of various URI components in the URL parser could be
used by attackers to bypass hostname-specific URL checks.
--- End Message ---
--- Begin Message ---
Version: 5.6.26+dfsg-1+rm
php5 was last released with Debian 8 (jessie) in April 2015
and was removed from the Debian archive afterwards.
It has been superseded by php7.0 and newer versions.
See https://bugs.debian.org/841781 for details on the removal.
Regular security support for jessie ended in June 2018 and LTS support
ended in June 2020.
I'm closing the remaining bug reports now.
Andreas
--- End Message ---
