SECUNIA ADVISORY ID: SA34081

VERIFY ADVISORY: http://secunia.com/advisories/34081/

DESCRIPTION: Some vulnerabilities have been reported in PHP, where some have an unknown impact an others can potentially be exploited by malicious people to disclose sensitive information or cause a DoS (Denial of Service).

1) An error within the "imagerotate()" function can be exploited to read arbitrary memory.
2) An unspecified error in the zip functionality can be exploited to cause a crash when file or directory entry names contain a relative path.

3) A vulnerability is caused due to an unspecified error within the "explode()" function. No further information is currently available.

4) An unspecified error exists when processing malformed strings passed to "json_decode()". No further information is currently available.

SOLUTION: Update to version 5.2.9 - http://www.php.net/downloads.php

PROVIDED AND/OR DISCOVERED BY:
1) The vendor credits Hamid Ebadi, APA Laboratory.
2 - 4) Reported by the vendor.

ORIGINAL ADVISORY: http://www.php.net/releases/5_2_9.php