Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
6.8
CVSSv2

CVE-2010-3870

Published: 12/11/2010 Updated: 13/02/2023
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
VMScore: 685
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Subscribe to Php

Vulnerability Summary

The utf8_decode function in PHP prior to 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes it easier for remote malicious users to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

php php

canonical ubuntu linux 10.10

canonical ubuntu linux 9.10

canonical ubuntu linux 8.04

canonical ubuntu linux 10.04

canonical ubuntu linux 6.06

Vendor Advisories

Debian CVElist Bug Report Logs: Three more security issues
Debian Bug report logs - #603751 Three more security issues Package: php5; Maintainer for php5 is Debian PHP Maintainers <pkg-php-maint@listsaliothdebianorg>; Source for php5 is src:php5 (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Tue, 16 Nov 2010 22:33:02 UTC Severity: important ...
Ubuntu Security Notice: php5 vulnerabilities
It was discovered that an integer overflow in the XML UTF-8 decoding code could allow an attacker to bypass cross-site scripting (XSS) protections This issue only affected Ubuntu 606 LTS, Ubuntu 804 LTS, and Ubuntu 910 (CVE-2009-5016) ...
Debian Security Advisories: DSA-2195-1 php5 -- several vulnerabilities
Stephane Chazelas discovered that the cronjob of the PHP 5 package in Debian suffers from a race condition which might be used to remove arbitrary files from a system (CVE-2011-0441) When upgrading your php5-common package take special care to accept the changes to the /etc/crond/php5 file Ignoring them would leave the system vulnerable For the ...

Exploits

Exploit DB: PHP 5.3.2 - 'xml_utf8_decode()' UTF-8 Input Validation
source: wwwsecurityfocuscom/bid/44605/info PHP is prone to a vulnerability because it fails to sufficiently sanitize user-supplied input Exploiting this issue can allow attackers to provide unexpected input and possibly bypass input-validation protection mechanisms This can aid in further attacks that may utilize crafted user-supplied ...

References

CWE-20http://sirdarckcat.blogspot.com/2009/10/couple-of-unicode-issues-on-php-and.htmlhttp://www.mandriva.com/en/security/advisories?name=MDVSA-2010:224http://bugs.php.net/bug.php?id=48230http://us2.php.net/manual/en/function.utf8-decode.php#83935http://www.openwall.com/lists/oss-security/2010/11/02/8http://www.openwall.com/lists/oss-security/2010/11/02/11http://www.acunetix.com/blog/web-security-articles/security-risks-associated-with-utf8_decode/http://bugs.php.net/bug.php?id=49687http://www.openwall.com/lists/oss-security/2010/11/02/4http://www.openwall.com/lists/oss-security/2010/11/02/6http://www.openwall.com/lists/oss-security/2010/11/03/1http://www.openwall.com/lists/oss-security/2010/11/02/1http://www.openwall.com/lists/oss-security/2010/11/02/2http://www.blackhat.com/presentations/bh-usa-09/VELANAVA/BHUSA09-VelaNava-FavoriteXSS-SLIDES.pdfhttp://svn.php.net/viewvc?view=revision&revision=304959http://www.redhat.com/support/errata/RHSA-2010-0919.htmlhttp://www.securityfocus.com/bid/44605http://www.securitytracker.com/id?1024797http://www.vupen.com/english/advisories/2010/3081http://secunia.com/advisories/42410http://www.vupen.com/english/advisories/2011/0020http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052845.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2011-January/052836.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.htmlhttp://www.php.net/ChangeLog-5.phphttp://www.ubuntu.com/usn/USN-1042-1http://secunia.com/advisories/42812http://www.vupen.com/english/advisories/2011/0021http://www.vupen.com/english/advisories/2011/0077http://www.redhat.com/support/errata/RHSA-2011-0195.htmlhttp://support.apple.com/kb/HT4581http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.htmlhttp://marc.info/?l=bugtraq&m=133469208622507&w=2https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=603751https://nvd.nist.govhttps://usn.ubuntu.com/1042-1/https://www.exploit-db.com/exploits/34950/
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
injectionCVE-2024-30983CVE-2023-4235CVE-2024-21338privilegeencryptionCVE-2023-4232CVE-2024-31497CVE-2024-32341
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook