CVE - CVE-2010-3870

CVE-ID
CVE-2010-3870	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MLIST:[oss-security] 20101102 Re: utf-8 security issue in php URL:http://www.openwall.com/lists/oss-security/2010/11/02/2 MLIST:[oss-security] 20101102 Re: utf-8 security issue in php URL:http://www.openwall.com/lists/oss-security/2010/11/02/4 MLIST:[oss-security] 20101102 Re: utf-8 security issue in php URL:http://www.openwall.com/lists/oss-security/2010/11/02/6 MLIST:[oss-security] 20101102 Re: utf-8 security issue in php URL:http://www.openwall.com/lists/oss-security/2010/11/02/8 MLIST:[oss-security] 20101102 Re: utf-8 security issue in php URL:http://www.openwall.com/lists/oss-security/2010/11/02/11 MLIST:[oss-security] 20101102 utf-8 security issue in php URL:http://www.openwall.com/lists/oss-security/2010/11/02/1 MLIST:[oss-security] 20101103 Re: utf-8 security issue in php URL:http://www.openwall.com/lists/oss-security/2010/11/03/1 MISC:http://bugs.php.net/bug.php?id=48230 MISC:http://sirdarckcat.blogspot.com/2009/10/couple-of-unicode-issues-on-php-and.html MISC:http://us2.php.net/manual/en/function.utf8-decode.php#83935 MISC:http://www.acunetix.com/blog/web-security-articles/security-risks-associated-with-utf8_decode/ MISC:http://www.blackhat.com/presentations/bh-usa-09/VELANAVA/BHUSA09-VelaNava-FavoriteXSS-SLIDES.pdf CONFIRM:http://bugs.php.net/bug.php?id=49687 CONFIRM:http://svn.php.net/viewvc?view=revision&revision=304959 CONFIRM:http://www.php.net/ChangeLog-5.php CONFIRM:http://support.apple.com/kb/HT4581 APPLE:APPLE-SA-2011-03-21-1 URL:http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html FEDORA:FEDORA-2010-18976 URL:http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052845.html FEDORA:FEDORA-2010-19011 URL:http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052836.html HP:HPSBOV02763 URL:http://marc.info/?l=bugtraq&m=133469208622507&w=2 HP:SSRT100826 URL:http://marc.info/?l=bugtraq&m=133469208622507&w=2 MANDRIVA:MDVSA-2010:224 URL:http://www.mandriva.com/en/security/advisories?name=MDVSA-2010:224 REDHAT:RHSA-2010:0919 URL:http://www.redhat.com/support/errata/RHSA-2010-0919.html REDHAT:RHSA-2011:0195 URL:http://www.redhat.com/support/errata/RHSA-2011-0195.html SUSE:SUSE-SR:2010:023 URL:http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html UBUNTU:USN-1042-1 URL:http://www.ubuntu.com/usn/USN-1042-1 BID:44605 URL:http://www.securityfocus.com/bid/44605 SECTRACK:1024797 URL:http://www.securitytracker.com/id?1024797 SECUNIA:42410 URL:http://secunia.com/advisories/42410 SECUNIA:42812 URL:http://secunia.com/advisories/42812 VUPEN:ADV-2010-3081 URL:http://www.vupen.com/english/advisories/2010/3081 VUPEN:ADV-2011-0020 URL:http://www.vupen.com/english/advisories/2011/0020 VUPEN:ADV-2011-0021 URL:http://www.vupen.com/english/advisories/2011/0021 VUPEN:ADV-2011-0077 URL:http://www.vupen.com/english/advisories/2011/0077
Assigning CNA
N/A
Date Entry Created
20101008	Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20101008)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: cve@mitre.org

Use of the Common Vulnerabilities and Exposures (CVE®) List and the associated references from this website are subject to the terms of use. CVE is sponsored by US-CERT in the office of Cybersecurity and Communications at the U.S. Department of Homeland Security. Copyright © 1999–2018, The MITRE Corporation. CVE and the CVE logo are registered trademarks of The MITRE Corporation. For more information, please contact us.