[php-maint] Bug#609315: Bug#609315: php5: Upstream bug CVE-2010-4645 / bug #53632, critical: conversion string>double might hang PHP interpreter

[Raphael Geissert]

notfound 609315 5.2.6.dfsg.1-1+lenny9
found 609315 5.3.3-1
thanks

On 8 January 2011 10:51, Jort Koopmans <jort.koopmans at gmail.com> wrote:
> On Sat, 2011-01-08 at 16:31 +0100, Julien Cristau wrote:
> [..]
>> Did you actually reproduce this with php 5.2.6.dfsg.1-1+lenny9?  AFAIK
>> people tried and couldn't.
>
> As mentioned in my update I couldnt reproduce it, but the 64bit build of
> php5 seems unaffected, so maybe users with a 32bit install should test
> it? If I understand the upstream buginfo correctly, both lenny and
> squeeze current releases (32bit) should be vulnerable to this bug. I'd
> recommend getting in touch with the people from PHP (Pajoye).

It can not be reproduced in lenny. The only indication I have for now
as to why it can't be reproduced is because the version of gcc in
lenny doesn't optimise zend_strotod by making use of the x87 unit in a
way that would make it hang.

Cheers,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net