Issues without CVE names in PHP 5.3.4/5.2.15 release

[Vincent Danen <vdanen () redhat com>]

Looking at the PHP web site, there are a few issues fixed in the most
recent releases that don't seem to have a CVE name:

* Fixed crash in zip extract method (possible CWE-170).
* Fixed symbolic resolution support when the target is a DFS share.
* Fixed extract() to do not overwrite $GLOBALS and $this when using EXTR_OVERWRITE.

Also doesn't seem to be much info on these readily available.

The first seems to be related to this SVN commit (don't see a bug for
it):

http://svn.php.net/viewvc?view=revision&revision=305848

The second seems to be Windows-specific and is this bug (haven't found
the SVN commit for it yet):

http://bugs.php.net/bug.php?id=51945

The third seems to be 5.2-specific (no mention in the 5.3 changes), but
I've not yet found the bug or SVN commit.

Do these have CVE names yet?

--
Vincent Danen / Red Hat Security Response Team