NVD

Id
52130  
Name
CVE-2009-5016  
Description
Integer overflow in the xml_utf8_decode function in ext/xml/xml.c in PHP before 5.2.11 makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string that uses overlong UTF-8 encoding, a different vulnerability than CVE-2010-3870.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2010-11-12  
Modified Date
2011-02-23  
Seq
2009-5016  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
263178 52130 CVE-2009-5016 http://bugs.php.net/bug.php?id=49687  View
263179 52130 CVE-2009-5016 FEDORA-2010-19011  View
263180 52130 CVE-2009-5016 FEDORA-2010-18976  View
263181 52130 CVE-2009-5016 http://sirdarckcat.blogspot.com/2009/10/couple-of-unicode-issues-on-php-and.html  View
263182 52130 CVE-2009-5016 http://www.blackhat.com/presentations/bh-usa-09/VELANAVA/BHUSA09-VelaNava-FavoriteXSS-SLIDES.pdf  View
263183 52130 CVE-2009-5016 RHSA-2010:0919  View
263184 52130 CVE-2009-5016 RHSA-2011:0195  View
263185 52130 CVE-2009-5016 44889  View
263186 52130 CVE-2009-5016 USN-1042-1  View
263187 52130 CVE-2009-5016 ADV-2010-3081  View
263188 52130 CVE-2009-5016 ADV-2011-0020  View
263189 52130 CVE-2009-5016 ADV-2011-0021  View
263190 52130 CVE-2009-5016 ADV-2011-0077  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
36755 JVNDB-2010-002535 PHP の xml_utf8_decode 関数における整数オーバーフローの脆弱性 PHP の ext/xml/xml.c 内にある xml_utf8_decode 関数には、整数オーバーフローの脆弱性が存在します。 CVE-2009-5016 42447 CVE-2009-5016 52130 6.8 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-002535.html 2010-11-12 2011-02-18 View