PHP 5.3.6 is available

Posted by & filed under PHP.

On March 17th, the PHP Group released PHP 5.3.6. This maintainance release, that focuses on security, is now available on Dotdeb for Debian 6.0 “Squeeze” in amd64 and i386 flavours. The compatibility with the official Debian packages has been improved and you (especially the FPM users) should really take care of some important changes that I… Read more »

You really should upgrade to PHP 5.3.5 or 5.2.17

Posted by & filed under PHP.

A few days after releasing PHP 5.3.4 and PHP 5.2.16, the PHP group announced an important security update with PHP 5.3.5 and PHP 5.2.17 : This release resolves a critical issue, reported as PHP bug #53632 and CVE-2010-4645, where conversions from string to double might cause the PHP interpreter to hang on systems using x87… Read more »

Packages of MySQL 5.1.53 are available for Lenny… and Squeeze!

Posted by & filed under MySQL.

MySQL 5.1.53 packages for Debian 5.0 « Lenny » are now available on Dotdeb in amd64/i386 flavours. Please note that they’re available as preview for Squeeze too. This maintainance release fixes many bugs and security issues. Upgrading is strongly recommended after having read the Changelogs here and here.

Upgrade to MySQL 5.1.51! It fixes a DoS vulnerability

Posted by & filed under MySQL.

MySQL versions prior to 5.1.51 (including 5.1.50) suffer from a vulnerability in the processing of arguments passed to the LEAST()or GREATEST() functions. This issue could be exploited by a malicious user to cause a server crash, leading to a DoS condition. You really should upgrade your Lenny servers (amd64 or i386) with the new packages of MySQL… Read more »

Dotdeb packages are now signed!

Posted by & filed under Miscellaneous.

After many requests from several users and after many months of promise, the Dotdeb repositories are GPG-signed. Yes, you can now get rid of the annoying “WARNING: The following packages cannot be authenticated!” message! Waiting for a dotdeb-keyring package, you just have to get the key and add it to your trusted keys’ keyring : gpg… Read more »

MySQL 5.1.47, a security-focused release, is available

Posted by & filed under MySQL.

MySQL 5.1.47 is now available on Dotdeb for your Lenny servers, in amd64 and i386 flavours. This is a security-oriented release that fixes some serious flaws… Please read full changelog for more information. Please also note that the InnoDB plugin has been upgraded to version 1.0.8 and is now considered of General Availability quality. Feel free… Read more »

May is the month of PHP security

Posted by & filed under PHP.

According to Stefan Esser, author of the Suhosin patch, May 2010 will be the “Month of PHP Security” : This initiative continues the effort of Hardened-PHP’s Month of PHP Bugs in 2007 to improve the security of PHP and the PHP ecosystem by disclosing vulnerabilities in PHP and PHP applications on the one hand and… Read more »

Etch security support discontinued by Debian on Feb. 15th…

Posted by & filed under Miscellaneous.

The Debian security team announced that Debian 4.0 “Etch” security support  will be ended on February 15th, 2010 : Security Support for Debian GNU/Linux 4.0 to be discontinued on February 15th One year after the release of Debian GNU/Linux 5.0 alias ‘lenny’ and nearly three years after the release of Debian GNU/Linux 4.0 alias ‘etch’… Read more »

MySQL 5.1.41 has been updated to fix a security issue

Posted by & filed under MySQL.

I just uploaded new MySQL 5.1.41 packages that fix a remote buffer overflow in MySQL servers that use the embedded YaSSL library : Lenz Grimmer gives more information about this issue CVE-2009-4484 has been filled Since Debian and Dotdeb are impacted, you are strongly encouraged to upgrade your servers.

MySQL 5.0.77 available

Posted by & filed under MySQL.

MySQL 5.0.77 packages are now available on Dotdeb for Debian Etch amd64/i386. This is a maintenance release that fix some annoying bugs and a severe security issue. Please read the official list of changes in 5.0.77  before upgrading.