5
CVSSv2

CVE-2010-4409

Published: 06/12/2010 Updated: 30/10/2018
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 505
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Summary

Integer overflow in the NumberFormatter::getSymbol (aka numfmt_get_symbol) function in PHP 5.3.3 and previous versions allows context-dependent malicious users to cause a denial of service (application crash) via an invalid argument.

Vulnerable Product Search on Vulmon Subscribe to Product

php php 4.0

php php 4.0.0

php php 4.2.0

php php 4.3.1

php php 4.3.7

php php 4.3.8

php php 4.4.5

php php 4.4.6

php php 3.0.12

php php 3.0.1

php php 3.0.17

php php 3.0.16

php php 2.0

php php 1.0

php php 5.3.0

php php 4.0.3

php php 4.0.4

php php 4.1.0

php php 4.2.2

php php 4.2.3

php php 4.3.2

php php 4.3.3

php php 4.3.4

php php 4.4.1

php php 4.4.2

php php 4.4.9

php php 3.0.11

php php 3.0.4

php php 3.0.3

php php 3.0.8

php php 3.0.5

php php 5.3.1

php php 5.3.2

php php 4.0.5

php php 4.0.6

php php 4.0.7

php php 4.1.1

php php 4.1.2

php php 4.3.0

php php 4.3.5

php php 4.3.6

php php 4.4.3

php php 4.4.4

php php 3.0.10

php php 3.0.13

php php 3.0.15

php php 3.0.14

php php 3.0.6

php php 2.0b10

php php 4.0.1

php php 4.0.2

php php 4.2.1

php php 4.3.10

php php 4.3.11

php php 4.3.9

php php 4.4.0

php php 4.4.7

php php 4.4.8

php php 3.0

php php 3.0.2

php php 3.0.18

php php 3.0.9

php php 3.0.7

php php

Vendor Advisories

It was discovered that an integer overflow in the XML UTF-8 decoding code could allow an attacker to bypass cross-site scripting (XSS) protections This issue only affected Ubuntu 606 LTS, Ubuntu 804 LTS, and Ubuntu 910 (CVE-2009-5016) ...

Exploits

From: Maksymilian Arciemowicz <cxib () securityreason com> Date: Fri, 10 Dec 2010 14:43:32 +0100 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [ PHP 533 NumberFormatter::getSymbol Integer Overflow ] Author: Maksymilian Arciemowicz securityreasoncom/ cxibnet/ Date: - - Dis: 11112010 - - Pub: 10122010 CERT: VU#479900 ...
PHP version 533 suffers from a NumberFormatter::getSymbol integer overflow vulnerability ...