Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:29540
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain hardened-php.net from 81.169.159.221 cause and error)
Message-ID: <464EAEB4.6010402@hardened-php.net>
Date: Sat, 19 May 2007 10:00:52 +0200
User-Agent: Thunderbird 2.0.0.0 (Windows/20070326)
MIME-Version: 1.0
To: Stanislav Malyshev <stas@zend.com>
Cc: internals@lists.php.net
References: <464DCB8C.90803@chiaraquartet.net> <7d5a202f0705181813l221248cdu85197a82a1ee4227@mail.gmail.com> <464E5856.5000901@zend.com> <464EA287.5020605@hardened-php.net> <464EA816.20406@zend.com>
In-Reply-To: <464EA816.20406@zend.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] potential solution to user streams + allow_url_include=off
From: sesser@hardened-php.net (Stefan Esser)


> If you are aware of some security problems in current PHP sources you
> are as always welcome to report them and they will be fixed. I think
> everybody here as always are thankful for any help we can get.
Ohh BTW. I am aware of many security problems in current PHP, actually
the whole world
is, because there are still a lot of "local" vulnerabilities unfixed
that were disclosed during
the MOPB. The ext/filter email issue is also not fixed in 5.2.2

And yes I know a bunch of bugs in PHP that were not disclosed during the
MOPB.

But what sense does it make to release them now, while a bunch of MOPB bugs
are not yet fixed or were marked as fixed in the release notes of 5.2.2
but were
not actually fixed.

Stefan