Found multiple vulnerabilities in PHP 5.2.x, some are of unknown impact and others could be exploited by a remote attacker to bypass certain security restrictions.
* A vulnerability is caused by an error in the handling of variables and could be exploited by a remote attacker to overwrite values in httpd.conf via the function ini_set ().
* The second vulnerability is caused by an error when processing files. Htaccess and could be exploited by a remote attacker to bypass the disable_functions directive if you modify the php.ini directive mail.force_extra_parameters through a file. Htaccess.
* Another vulnerability is caused by several errors limit the functions fnmatch (), setlocale () and balloons () which could be exploited by a remote attacker to cause buffer overflows.
The final vulnerability is caused by several errors in the functions and htmlentities htmlspecialchars not accept partial multibyte sequences.
Are advised to upgrade to version 5.2.5 is available from:
http://www.php.net/downloads.php
More information:
Source: Hispasec
PHP 5.2.5 Release Announcement
http://www.php.net/releases/5_2_5.php
