CVE-2010-4409
MEDIUM
5.0
CVSS 2.0
Description
Integer overflow in the NumberFormatter::getSymbol (aka numfmt_get_symbol) function in PHP 5.3.3 and earlier allows context-dependent attackers to cause a denial of service (application crash) via an invalid argument.
Affected products and versions
- PHP — Up to and including 5.3.3
- PHP versions 1.0, 2.0, 2.0b10, 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.0.16, 3.0.17, 3.0.18, 4.0, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0beta1, 4.0beta2, 4.0beta3, 4.0beta4, 4.0beta_4_patch1, 4.1.0, 4.1.1, 4.1.2, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.4.6, 4.4.7, 4.4.8, 4.4.9, 5.3.0, 5.3.1, 5.3.2
References
- lists.apple.com http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
- lists.fedoraproject.org http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052836.html
- lists.fedoraproject.org http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052845.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2012-01/msg00035.html
- secunia.com http://secunia.com/advisories/42812
- secunia.com http://secunia.com/advisories/47674
- support.apple.com http://support.apple.com/kb/HT4581
- svn.php.net http://svn.php.net/viewvc/php/php-src/trunk/ext/intl/formatter/formatter_attr.c?r1=305571&r2=305570&pathrev=305571 Patch
- svn.php.net http://svn.php.net/viewvc?view=revision&revision=305571 Patch
- www.exploit-db.com http://www.exploit-db.com/exploits/15722
- www.kb.cert.org http://www.kb.cert.org/vuls/id/479900 US Government Resource
- www.mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2010:254
- www.mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2010:255
- www.php.net http://www.php.net/ChangeLog-5.php
- www.securityfocus.com http://www.securityfocus.com/archive/1/515142/100/0/threaded
- www.securityfocus.com http://www.securityfocus.com/bid/45119
- www.ubuntu.com http://www.ubuntu.com/usn/USN-1042-1
- www.vupen.com http://www.vupen.com/english/advisories/2011/0020
- www.vupen.com http://www.vupen.com/english/advisories/2011/0021
- www.vupen.com http://www.vupen.com/english/advisories/2011/0077
- nvd.nist.gov Official NVD record