Secunia

A security issue and multiple vulnerabilities have been reported in PHP, where the vulnerabilities have an unspecified impact and the security issue can be exploited by malicious people to bypass certain security restrictions.

1) An unspecified error exists in the certificate validation in "php_openssl_apply_verification_policy".

2) An input validation error exists related to the color index in "imagecolortransparent()".

3) An input validation error exists in the processing of exif data.

4) An integer truncation error within the "utf8_decode()" function when processing certain UTF characters can be exploited to e.g. bypass security filters and subsequently conduct cross-site scripting and SQL injection attacks.

The security issue and vulnerabilities have been reported in versions prior to 5.2.11.

Solution
Update to version 5.2.11.

Provided and/or discovered by
1-3) Reported by the vendor.
4) sirdarckcat.

Changelog
Further details available in Customer Area

Original Advisory
http://www.php.net/releases/5_2_11.php

4) http://bugs.php.net/bug.php?id=49687
http://sirdarckcat.blogspot.com/2009/10/couple-of-unicode-issues-on-php-and.html

Deep Links
Links available in Customer Area