PEAR Blog » Announcements http://blog.pear.php.net Official pear.php.net blog Tue, 24 Jan 2012 14:05:29 +0000 en hourly 1 http://wordpress.org/?v=3.1.2 PEAR channels on google code currently broken http://blog.pear.php.net/2010/03/23/google-code-channels-broken/ http://blog.pear.php.net/2010/03/23/google-code-channels-broken/#comments Tue, 23 Mar 2010 15:55:32 +0000 cweiske http://blog.pear.php.net/?p=71 Continue reading →]]> PEAR channels hosted on google code (like the unofficial Smarty channel, unofficial Zend Framework channel and the unofficial Mediawiki channel) are currently broken.

The reason for it has been discovered in the corresponding bug report: HTTP requests containing a port number in the “Host” header field are rejected, returning a 404.

The issue is currently being investigated by Google. If you cannot wait, apply a hack-fix to your PEAR installation. Alternatively, use Pyrus, the next-gen PEAR installer.

]]> http://blog.pear.php.net/2010/03/23/google-code-channels-broken/feed/ 1 Net_Traceroute and Net_Ping security advisory http://blog.pear.php.net/2009/11/14/net_traceroute-and-net_ping-security-advisory/ http://blog.pear.php.net/2009/11/14/net_traceroute-and-net_ping-security-advisory/#comments Sat, 14 Nov 2009 23:39:49 +0000 david http://blog.pear.php.net/?p=57 Continue reading →]]> PEAR Security Advisory (PSA 200911-14-01)

Severity: Serious
Title: PEAR Net_Ping and Net_Traceroute Remote Arbitrary Command Injection
Date: November 14, 2009
ID: 200911-14-01

Synopsis

Multiple remote arbitrary command injections have been found in the Net_Ping
and Net_Traceroute.

Background

Net_Ping is an OS independent wrapper class for executing ping calls from PHP

Net_Traceroute is an OS independent wrapper class for executing traceroute calls from PHP

Affected packages

———————————————————————————————
Package                   /  Vulnerable  /             Unaffected
———————————————————————————————
1  Net_Ping                   < 2.4.5                   >= 2.4.5
2  Net_Traceroute       < 0.21.2                  >= 0.21.2

———————————————————————————————
2 affected packages on all of their supported architectures.
———————————————————————————————

Description

Remote Arbitrary Command Injection

Impact

When input from forms are used directly, the attacker could pass variables that would allow him to execute remote arbitrary command injections.

Workaround

Filter your input to make sure the commands passed are shell escaped or upgrade to the latest version of both packages.

Resolution

The group recommends users of Net_Ping to upgrade to Net_Ping-2.4.5 if they haven’t already:

The group recommends users of Net_Traceroute to upgrade to Net_Traceroute-0.21.2 if they haven’t already:

Reported By

Thanks to Pasquale Imperato for finding, analyzing and reporting the issue.

Link

http://pear.php.net/advisory20091114-01.txt

]]> http://blog.pear.php.net/2009/11/14/net_traceroute-and-net_ping-security-advisory/feed/ 4 Ubuntu Karmic Ships with PEAR-Affecting Issues http://blog.pear.php.net/2009/11/03/ubuntu-karmic-ships-with-pear-affecting-issues/ http://blog.pear.php.net/2009/11/03/ubuntu-karmic-ships-with-pear-affecting-issues/#comments Tue, 03 Nov 2009 22:32:42 +0000 ashnazg http://blog.pear.php.net/?p=51 Continue reading →]]> Be aware that the initial release of Ubuntu Karmic contains a bug that affects PHP and PEAR, whose fix came a tad too late to make the initial release.  The bug is fixed, and will be included in upcoming updates from Ubuntu.

From PEAR’s perspective, the key issue relates to the zlib library.  This is evident in any attempt to install or upgrade a package, since doing so involves downloading a tarball file that must be uncompressed.  The bug causes some zlib functions to be unavailable to PHP, and the Archive_Tar code will silently fail due to this.

If you attempt to install or upgrade a package, it may appear to finish without error, but without a final “install ok” or “upgrade ok” message.  This means the process failed.  The workaround is to include the -Z argument, so that a .tar file will be downloaded rather than a .tgz file:

pear install -Z phpdocumentor

]]> http://blog.pear.php.net/2009/11/03/ubuntu-karmic-ships-with-pear-affecting-issues/feed/ 11 PEAR Website Outage http://blog.pear.php.net/2009/09/25/pear-website-outage/ http://blog.pear.php.net/2009/09/25/pear-website-outage/#comments Fri, 25 Sep 2009 20:47:22 +0000 ashnazg http://blog.pear.php.net/?p=44 Continue reading →]]> The PEAR website is currently unavailable due to network issues where the server is located. The hosting provider is working to restore service.

In the meantime, the best alternative for PEAR installer usage is to point your “preferred_mirror” to one of the mirror PEAR channel servers. Use one of the commands below to choose a mirror near you:

  • U.S: pear config-set preferred_mirror us.pear.php.net
  • Germany: pear config-set preferred_mirror de.pear.php.net

If you are using a PEAR installer older than version 1.9.0, and the preferred_mirror settings do not work successfully for you, a manual alternative for retrieving packages is to use the “download” command and point directly to the tarball file:

  • pear download http://us.pear.php.net/get/PEAR-1.9.0.tgz
  • pear download http://de.pear.php.net/get/PEAR-1.9.0.tar

If using this option, you must specify the package name in the correct case, while including the version number and the file type:

  • PEAR-1.9.0.tgz
  • Archive_Tar-1.2.3.tar
]]> http://blog.pear.php.net/2009/09/25/pear-website-outage/feed/ 2 The new Group has been elected! http://blog.pear.php.net/2009/08/10/the-new-group-has-been-elected/ http://blog.pear.php.net/2009/08/10/the-new-group-has-been-elected/#comments Mon, 10 Aug 2009 18:42:00 +0000 david http://blog.pear.php.net/?p=38 Continue reading →]]> I am more than glad to announce the arrival, the announcement of the new PEAR Group for 2009 and 2010.

With a few fresh faces in the Group, this year looks very promising with the mix of both new blood and experienced PEAR Group members.

Congratulations to the elected 7s (In no particular order):

  • Christian Weiske
  • Chuck Burgress
  • Daniel O’Connor
  • Ken Guest
  • Bill Shupp
  • Michael Gauthier
  • Brett Bieber

I can’t wait to have our first meeting and get the year kicking!

Thanks to everyone who voted!

]]> http://blog.pear.php.net/2009/08/10/the-new-group-has-been-elected/feed/ 5 The elections are still going! http://blog.pear.php.net/2009/08/01/the-elections-are-still-going/ http://blog.pear.php.net/2009/08/01/the-elections-are-still-going/#comments Sat, 01 Aug 2009 12:42:37 +0000 david http://blog.pear.php.net/?p=35 Continue reading →]]> As every year, the elections for the PEAR Group and PEAR President are happening. This year due to a few factors and messages lost in translation, we decided to extend the elections period by 10 days so more people would have time to vote!

So remember to cast your vote at http://pear.php.net/election/ and you have until the the 5th of August 2009.

There are many new candidates for the Group and I think you should go and check them out!

]]> http://blog.pear.php.net/2009/08/01/the-elections-are-still-going/feed/ 2 PHP 5.3 Windows and PEAR (go-pear.phar) http://blog.pear.php.net/2009/07/01/php-53-windows-and-pear/ http://blog.pear.php.net/2009/07/01/php-53-windows-and-pear/#comments Wed, 01 Jul 2009 12:22:55 +0000 cweiske http://blog.pear.bluga.net/?p=28 Continue reading →]]> Some users have reported that the windows builds of PHP 5.3 are not able to open the shipped go-pear.phar file.

As a workaround, users can run the distributed phar with php -d phar.require_hash=0 go-pear.phar or download and use the http://pear.php.net/go-pear non-pharred version.

]]> http://blog.pear.php.net/2009/07/01/php-53-windows-and-pear/feed/ 41 Election 2008 Results http://blog.pear.php.net/2008/06/22/election-2008-results/ http://blog.pear.php.net/2008/06/22/election-2008-results/#comments Sun, 22 Jun 2008 17:24:15 +0000 jeichorn http://blog.pear.php.net/?p=20 Continue reading →]]> 2008 Elections are now over, you can view the offical results on the PEAR website.

The new PEAR group is:

elections are now over and a new PEAR Group has been formed. Just like last year and always following the Constitution, the new members have been elected by a secret ballot of PEAR Developers. They have chosen:

  • Joshua Eichorn
  • Helgi Þormar Þorbjornsson
  • Joe Stump
  • Christian Weiske
  • Chuck Burgess
  • Travis Swicegood
  • Brett Bieber

The new PEAR President is: David Coallier

The kickoff meeting for the new group is being held today.

]]> http://blog.pear.php.net/2008/06/22/election-2008-results/feed/ 0 Election time 2008 http://blog.pear.php.net/2008/06/04/election-time-2008/ http://blog.pear.php.net/2008/06/04/election-time-2008/#comments Wed, 04 Jun 2008 16:13:42 +0000 david http://blog.pear.php.net/2008/06/04/election-time-2008/ Continue reading →]]> As every year it is the time of the election for the PEAR Group and PEAR President for the year 2008 and 2009. If you haven’t casted your vote just yet, NOW is the perfect time to do it so go to the election page and place your vote.

This year’s election contains a great mix of fresh mindsets, experienced and long time PEAR users and members of last year’s PEAR Group.

Go, vote!

]]> http://blog.pear.php.net/2008/06/04/election-time-2008/feed/ 0 PEAR communities http://blog.pear.php.net/2007/10/20/pear-communities/ http://blog.pear.php.net/2007/10/20/pear-communities/#comments Sat, 20 Oct 2007 15:36:06 +0000 Greg http://blog.pear.php.net/2007/10/20/pear-communities/ Continue reading →]]> Those of you on linkedin.com should join the PEAR group, it is open to all.  Those of you on facebook.com should join the PEAR group, just search for “PEAR” and it will pop up.

These groups are primarily for fun, but also act as networking tools to get to know the people who are developing and using PEAR.  The official support channels for PEAR are still the mailing lists and bug tracker, and are listed at http://pear.php.net/support.php

]]> http://blog.pear.php.net/2007/10/20/pear-communities/feed/ 2