Branches for Breezy

Author: Adam Conrad
Revision Date: 2005-09-27 16:12:05 UTC

* Remove Andres Salomon from the Uploaders field, at his request. Thanks
  for all your work on the PHP packages, Andres, now fix our kernel bugs.
* Add 054-open_basedir_slash.patch, which fixes a bug where if open_basedir
  is set to "/foo/", users can access files in "/foobar/", which is not the
  documented behaviour; this addresses CAN-2005-3054 (closes: #323585)
* Add 055-gd_safe_mode_checks.patch from PHP CVS, adding missing safe_mode
  checks to the _php_image_output and _php_image_output_ctx GD functions.

Author: Adam Conrad
Revision Date: 2006-03-08 17:50:13 UTC

* SECURITY UPDATE: multiple fixes backported from 5.1.2 and CVS:
  - Fix multiple HTTP response splitting vulnerabilities in sessions and
    the header() function, due to lack of input validation; CVE-2006-0207
    + Add safety checks in the header() function to make sure that we
      don't get newlines injected by (mis)use of user input in headers.
    + Add a check for invalid characters in session names, so that we
      aren't subject to HTTP response splitting vulnerabilities in
      the Set-Cookie header we send back out as a result of user input.
  - Filter HTML error reporting, preventing cross-site scripting attacks
    when both display_errors and html_errors are enabled; CVE-2006-0208