Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:27366
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 64.233.184.230 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
        b=ReNuLsfWkbV5Gop2Mms/SGvOcvuFKBL4gw+h0ThGPcg8sn/F3I/8Py5ufFXGMTOpuaX9cz9C0BPwN2c0PQ/kap/JxrD2ycmCSuUoSFsQqadnnMyxUawdYvPyhdEJIY5VmPhc5+cgfcMiLFmTzbDzebFPfnfVny2DIzpLXTUvBTI=
Message-ID: <fe05d1540701110827j4593dbddr28ef89feb6b01949@mail.gmail.com>
Date: Thu, 11 Jan 2007 17:27:33 +0100
To: "Stefan Esser" <sesser@hardened-php.net>
Cc: "Alain Williams" <addw@phcomp.co.uk>, internals@lists.php.net, 
	kel@securityfocus.com, security@php.net
In-Reply-To: <45A66391.1090302@hardened-php.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <20070111144144.GV15998@mint.phcomp.co.uk>
	 <45A65B19.40900@lerdorf.com> <45A6600D.1090500@hardened-php.net>
	 <fe05d1540701110814u3f8de1ber4329d9c9c2a6e201@mail.gmail.com>
	 <45A66391.1090302@hardened-php.net>
Subject: Re: [PHP-DEV] Comments on PHP security
From: pierre.php@gmail.com (Pierre)

Hi Stefan,

On 1/11/07, Stefan Esser <sesser@hardened-php.net> wrote:
>
> > For your information, zip is not enabled by default. If you have a
> > bug/issue about the specific zip:// URL, please let me know. Ilia and
> > Tony already fixed some paths fixes and the fixes are available in
> > zip-1.8.4. They will be in 5.2.1.
> For your information Pierre: Security Bugs in PHP are usually found by
> me. So guess twice WHO told security@php.net that there are
> bufferoverflows in zip:// URLs and WHY there have been bugfixes to ext/zip.

No idea who posted them or if someone posted something about zip. As
you know I have no access to security@ and so far all I see are
commits in my packages without much explanations. Not like I do not
want you or anyone else to help or to do not give you the credits. But
I did not know that someone else reported the issues, I apologize for
that.

> BTW: Last time I checked, popular packages like dotdeb PHP activate
> ext/zip by default...
>
> And yes... Also prepare for the ***more than 30 vulnerabilities*** I
> disclosed to security@php.net during the last 3 weeks.

Nice, better later than never. Remember my numerous requests in the
last months *BEFORE* the stable release (and you were still a PHP
Securtiy member)?

> Have fun...

I have fun anyway, if not I will not bother to discuss that here.

--Pierre