Integer overflow in the xml_utf8_decode function in ext/xml/xml.c in PHP before 5.2.11 makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string that uses overlong UTF-8 encoding, a different vulnerability than CVE-2010-3870.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade php-xmlUpgrade php-mysqlUpgrade php-commonUpgrade php-imapUpgrade php-odbcUpgrade php-pgsqlUpgrade php-domxmlUpgrade php-cliUpgrade php-ncursesUpgrade php-xmlrpcUpgrade php-snmpUpgrade php-mbstringUpgrade php-ldapUpgrade php-dbaUpgrade php-gdUpgrade phpUpgrade php-develUpgrade php-soapUpgrade php-bcmathUpgrade php-pdoUpgrade php-pear | Dec 1, 2016 | Nov 12, 2010 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 30, 2017 | Nov 12, 2010 |
| Oracle_linux | — | Upgrade php-imapUpgrade php-xmlrpcUpgrade php-embeddedUpgrade php-develUpgrade phpUpgrade php-pspellUpgrade php-gdUpgrade php-ztsUpgrade php-processUpgrade php-bcmathUpgrade php-xmlUpgrade php-mbstringUpgrade php-cliUpgrade php-recodeUpgrade php-mysqlUpgrade php-enchantUpgrade php-tidyUpgrade php-snmpUpgrade php-pdoUpgrade php-odbcUpgrade php-commonUpgrade php-pgsqlUpgrade php-soapUpgrade php-dbaUpgrade php-ncursesUpgrade php-ldapUpgrade php-intl | Oct 16, 2024 | Nov 12, 2010 |
| Php | — | Upgrade to PHP version 5.2.11 | Oct 1, 2012 | Nov 12, 2010 |
| Ubuntu | — | Upgrade libapache2-mod-php5Upgrade php5-cgiUpgrade php5-cli | Nov 8, 2024 | Nov 12, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub