Secunia

Some vulnerabilities and weaknesses have been reported in PHP, where some have unknown impacts and others can be exploited to bypass certain security restrictions.

1) Various errors exist in the "htmlentities" and "htmlspecialchars" functions where partial multibyte sequences are not accepted.

2) Various boundary errors exist in the "fnmatch()", "setlocale()", and "glob()" functions and can be exploited to cause buffer overflows.

3) An error in the processing of the "mail.force_extra_parameters" directive within an ".htaccess" file can be exploited to bypass the "safe_mode" directive.

4) An error in the handling of variables can be exploited to overwrite values set in httpd.conf via the "ini_set()" function.

Solution
Update to version 5.2.5.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits:
1) Rasmus Lerdorf
2) Laurent Gaffie
3) SecurityReason

Changelog
Further details available in Customer Area

Original Advisory
PHP:
http://www.php.net/releases/5_2_5.php

SecurityReason:
http://securityreason.com/achievement_securityalert/47

Deep Links
Links available in Customer Area