CVE-2008-5557
HIGH
10.0
CVSS 2.0
Description
Heap-based buffer overflow in ext/mbstring/libmbfl/filters/mbfilter_htmlent.c in the mbstring extension in PHP 4.3.0 through 5.2.6 allows context-dependent attackers to execute arbitrary code via a crafted string containing an HTML entity, which is not properly handled during Unicode conversion, related to the (1) mb_convert_encoding, (2) mb_check_encoding, (3) mb_convert_variables, and (4) mb_parse_str functions.
Affected products and versions
- PHP versions 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.4.6, 4.4.7, 4.4.8, 4.4.9, 5.0.0, 5.0.0beta1, 5.0.0beta2, 5.0.0beta3, 5.0.0beta4, 5.0.0rc1, 5.0.0rc2, 5.0.0rc3, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.1.6, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6
References
- archives.neohapsis.com http://archives.neohapsis.com/archives/fulldisclosure/2008-12/0477.html
- bugs.php.net http://bugs.php.net/bug.php?id=45722 Exploit
- cvs.php.net http://cvs.php.net/viewvc.cgi/php-src/ext/mbstring/libmbfl/filters/mbfilter_htmlent.c?r1=1.7&r2=1.8 Exploit
- h20000.www2.hp.com http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444
- lists.apple.com http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html
- marc.info http://marc.info/?l=bugtraq&m=124654546101607&w=2
- marc.info http://marc.info/?l=bugtraq&m=125631037611762&w=2
- secunia.com http://secunia.com/advisories/34642
- secunia.com http://secunia.com/advisories/35003
- secunia.com http://secunia.com/advisories/35074
- secunia.com http://secunia.com/advisories/35306
- secunia.com http://secunia.com/advisories/35650
- securitytracker.com http://securitytracker.com/id?1021482
- support.apple.com http://support.apple.com/kb/HT3549
- wiki.rpath.com http://wiki.rpath.com/Advisories:rPSA-2009-0035
- www.debian.org http://www.debian.org/security/2009/dsa-1789
- www.mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2009:045
- www.php.net http://www.php.net/ChangeLog-5.php#5.2.7
- www.redhat.com http://www.redhat.com/support/errata/RHSA-2009-0350.html
- www.securityfocus.com http://www.securityfocus.com/archive/1/501376/100/0/threaded
- www.securityfocus.com http://www.securityfocus.com/bid/32948
- www.us-cert.gov http://www.us-cert.gov/cas/techalerts/TA09-133A.html US Government Resource
- www.vupen.com http://www.vupen.com/english/advisories/2009/1297
- exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/47525
- oval.cisecurity.org https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10286
- www.redhat.com https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01451.html
- www.redhat.com https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01465.html
- nvd.nist.gov Official NVD record