Month of PHP Security 2010 Issues

[Eren Türkay <eren () pardus org tr>]

Hello,

Several CVE IDs have been assigned to issues mentioned in Month of PHP
Security 2010 page [0] However, there are issues for which CVE IDs have not yet
been assiged. Is it possible to assign CVE IDs for these issues as well?
It should be noted that these issues I am referring to are PHP issues,
not PHP applications.

Additionally, is there anyone who has a contact with upstream about these issues? It
would be really helpful to know the state of these issues (whether fixed, wheter in php bugzilla, etc)

[0] http://php-security.org/

Here is a list that I also mailed to bugtraq and full-disclosure in
response to Stefan Esser.

> Vulnerabilities in PHP
> ----------------------
>
> MOPS-2010-017: PHP preg_quote() Interruption Information Leak
> Vulnerability - http://bit.ly/cUYsbj
> MOPS-2010-016: PHP ZEND_SR Opcode Interruption Address Information Leak
> Vulnerability - http://bit.ly/bwT28V
> MOPS-2010-015: PHP ZEND_SL Opcode Interruption Address Information Leak
> Vulnerability - http://bit.ly/a3BonY
> MOPS-2010-014: PHP ZEND_BW_XOR Opcode Interruption Address Information
> Leak Vulnerability - http://bit.ly/cdMzTo

Not assigned yet

> MOPS-2010-013: PHP sqlite_array_query() Uninitialized Memory Usage
> Vulnerability - http://bit.ly/bhHyrj
> MOPS-2010-012: PHP sqlite_single_query() Uninitialized Memory Usage
> Vulnerability - http://bit.ly/8Z8xYt

- CVE-2010-1868 (for both issues)

> MOPS-2010-010: PHP html_entity_decode() Interruption Information Leak
> Vulnerability - http://bit.ly/doxAXk

- CVE-2010-1860

> MOPS-2010-009: PHP shm_put_var() Already Freed Resource Access
> Vulnerability - http://bit.ly/b4NBD8

- CVE-2010-1861

> MOPS-2010-008: PHP chunk_split() Interruption Information Leak
> Vulnerability - http://bit.ly/cVoWoM

- CVE-2010-1862

> MOPS-2010-006: PHP addcslashes() Interruption Information Leak
> Vulnerability - http://bit.ly/b5gkaf

- CVE-2010-1864

> MOPS-2010-003: PHP dechunk Filter Signed Comparison Vulnerability -
> http://bit.ly/bXDivD

- CVE-2010-1866

> MOPS-2010-001: PHP hash_update_file() Already Freed Resource Access
> Vulnerability - http://bit.ly/aZDRha

Not assigned yet

Thanks,
Eren