| Name | CVE-2008-2829 |
| Description | php_imap.c in PHP 5.2.5, 5.2.6, 4.x, and other versions, uses obsolete API calls that allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long IMAP request, which triggers an "rfc822.c legacy routine buffer overflow" error message, related to the rfc822_write_address function. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DTSA-144-1 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| php5 (PTS) | jessie, jessie (lts) | 5.6.40+dfsg-0+deb8u21 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| php5 | source | lenny | 5.2.5-3+lenny2 | DTSA-144-1 | ||
| php5 | source | (unstable) | 5.2.6-2 | low |
[etch] - php5 <no-dsa> (Fix not feasible for etch, low priority issue)
the fix sent to t-s and unstable does not seem possible in etch due to
missing api features from the version of libc-client in etch.