[Mageia-dev] New security issues affect libzip and php (freeze push will be needed)

[David Walser]

New vulnerabilities CVE-2012-1162 (heap overflow) and CVE-2012-1163 (integer overflow) in libzip, which also affect PHP (probably the php-zip subpackage) were recently announced.

libzip 0.10.1 has been released to fix these.  I have updated it in SVN and confirmed it builds, but I have not tested it yet.

PHP has not yet issued an update for this.

References:
https://bugs.mageia.org/show_bug.cgi?id=5063
http://seclists.org/oss-sec/2012/q1/710
https://bugzilla.redhat.com/show_bug.cgi?id=802564
https://bugzilla.redhat.com/show_bug.cgi?id=803028