Secunia

Multiple vulnerabilities have been reported in PHP, some of which have unknown impact and others that can be exploited by malicious users to bypass certain security restrictions and by malicious people to cause a DoS (Denial of Service).

1) Input validation errors exist in the processing of exif data.

This is related to vulnerability #3 in:
SA36791

2) An error in "tempnam()" can be exploited to bypass the "safe_mode" feature.

3) An error in "posix_mkfifo()" can be exploited to bypass the "open_basedir" feature.

4) An error within the processing of form-based file uploads can be exploited to cause a DoS by sending specially crafted requests.

Successful exploitation requires that "file_uploads" is enabled.

Solution
Update to version 5.3.1.

Provided and/or discovered by
1) Reported by the vendor.
2, 3) Grzegorz Stachowiak
4) Bogdan Calin, Acunetix

Changelog
Further details available in Customer Area

Original Advisory
PHP:
http://www.php.net/releases/5_3_1.php

Grzegorz Stachowiak:
http://securityreason.com/securityalert/6600
http://securityreason.com/securityalert/6601

Acunetix:
http://www.acunetix.com/blog/websecuritynews/php-multipartform-data-denial-of-service/

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area