National Cyber Awareness System

Vulnerability Summary for CVE-2010-3870

Overview

The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://svn.php.net/viewvc?view=revision&revision=304959

Type: Patch Information

Hyperlink:http://svn.php.net/viewvc?view=revision&revision=304959

External Source: VUPEN

Name: ADV-2011-0077

Hyperlink:http://www.vupen.com/english/advisories/2011/0077

External Source: VUPEN

Name: ADV-2011-0021

Hyperlink:http://www.vupen.com/english/advisories/2011/0021

External Source: VUPEN

Name: ADV-2011-0020

Hyperlink:http://www.vupen.com/english/advisories/2011/0020

External Source: VUPEN

Name: ADV-2010-3081

Hyperlink:http://www.vupen.com/english/advisories/2010/3081

External Source: UBUNTU

Name: USN-1042-1

Hyperlink:http://www.ubuntu.com/usn/USN-1042-1

External Source: SECTRACK

Name: 1024797

Hyperlink:http://www.securitytracker.com/id?1024797

External Source: BID

Name: 44605

Hyperlink:http://www.securityfocus.com/bid/44605

External Source: REDHAT

Name: RHSA-2011:0195

Hyperlink:http://www.redhat.com/support/errata/RHSA-2011-0195.html

External Source: REDHAT

Name: RHSA-2010:0919

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0919.html

External Source: CONFIRM

Name: http://www.php.net/ChangeLog-5.php

Hyperlink:http://www.php.net/ChangeLog-5.php

External Source: MLIST

Name: [oss-security] 20101103 Re: utf-8 security issue in php

Hyperlink:http://www.openwall.com/lists/oss-security/2010/11/03/1

External Source: MLIST

Name: [oss-security] 20101102 Re: utf-8 security issue in php

Hyperlink:http://www.openwall.com/lists/oss-security/2010/11/02/8

External Source: MLIST

Name: [oss-security] 20101102 Re: utf-8 security issue in php

Hyperlink:http://www.openwall.com/lists/oss-security/2010/11/02/6

External Source: MLIST

Name: [oss-security] 20101102 Re: utf-8 security issue in php

Hyperlink:http://www.openwall.com/lists/oss-security/2010/11/02/4

External Source: MLIST

Name: [oss-security] 20101102 Re: utf-8 security issue in php

Hyperlink:http://www.openwall.com/lists/oss-security/2010/11/02/2

External Source: MLIST

Name: [oss-security] 20101102 Re: utf-8 security issue in php

Hyperlink:http://www.openwall.com/lists/oss-security/2010/11/02/11

External Source: MLIST

Name: [oss-security] 20101102 utf-8 security issue in php

Hyperlink:http://www.openwall.com/lists/oss-security/2010/11/02/1

External Source: MANDRIVA

Name: MDVSA-2010:224

Hyperlink:http://www.mandriva.com/en/security/advisories?name=MDVSA-2010:224

External Source: MISC

Name: http://www.blackhat.com/presentations/bh-usa-09/VELANAVA/BHUSA09-VelaNava-FavoriteXSS-SLIDES.pdf

Hyperlink:http://www.blackhat.com/presentations/bh-usa-09/VELANAVA/BHUSA09-VelaNava-FavoriteXSS-SLIDES.pdf

External Source: MISC

Name: http://www.acunetix.com/blog/web-security-articles/security-risks-associated-with-utf8_decode/

Hyperlink:http://www.acunetix.com/blog/web-security-articles/security-risks-associated-with-utf8_decode/

External Source: MISC

Name: http://us2.php.net/manual/en/function.utf8-decode.php#83935

Hyperlink:http://us2.php.net/manual/en/function.utf8-decode.php#83935

External Source: CONFIRM

Name: http://support.apple.com/kb/HT4581

Hyperlink:http://support.apple.com/kb/HT4581

External Source: MISC

Name: http://sirdarckcat.blogspot.com/2009/10/couple-of-unicode-issues-on-php-and.html

Hyperlink:http://sirdarckcat.blogspot.com/2009/10/couple-of-unicode-issues-on-php-and.html

External Source: SECUNIA

Name: 42812

Hyperlink:http://secunia.com/advisories/42812

External Source: SECUNIA

Name: 42410

Hyperlink:http://secunia.com/advisories/42410

External Source: SUSE

Name: SUSE-SR:2010:023

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html

External Source: FEDORA

Name: FEDORA-2010-18976

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052845.html

External Source: FEDORA

Name: FEDORA-2010-19011

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052836.html

External Source: APPLE

Name: APPLE-SA-2011-03-21-1

Hyperlink:http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html

External Source: CONFIRM

Name: http://bugs.php.net/bug.php?id=49687

Hyperlink:http://bugs.php.net/bug.php?id=49687

External Source: MISC

Name: http://bugs.php.net/bug.php?id=48230

Hyperlink:http://bugs.php.net/bug.php?id=48230