CVE-2008-5557 Heap-based buffer overflow in ext/mbstring/libmbfl/filters/mbfilter_htmlent.c in the mbstring extension in PHP 4.3.0 through 5.2.6 allows context-dependent attackers to execute arbitrary code via a cr...
HighCVSS 10.0
EPSS 7.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in ext/mbstring/libmbfl/filters/mbfilter_htmlent.c in the mbstring extension in PHP 4.3.0 through 5.2.6 allows context-dependent attackers to execute arbitrary code via a crafted string containing an HTML entity, which is not properly handled during Unicode conversion, related to the (1) mb_convert_encoding, (2) mb_check_encoding, (3) mb_convert_variables, and (4) mb_parse_str functions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | = 4.3.0 | No fix listed |
| PHP | = 4.3.1 | No fix listed |
| PHP | = 4.3.2 | No fix listed |
| PHP | = 4.3.3 | No fix listed |
| PHP | = 4.3.4 | No fix listed |
| PHP | = 4.3.5 | No fix listed |
| PHP | = 4.3.6 | No fix listed |
| PHP | = 4.3.7 | No fix listed |
| PHP | = 4.3.8 | No fix listed |
| PHP | = 4.3.9 | No fix listed |
| PHP | = 4.3.10 | No fix listed |
| PHP | = 4.3.11 | No fix listed |
| PHP | = 4.4.0 | No fix listed |
| PHP | = 4.4.1 | No fix listed |
| PHP | = 4.4.2 | No fix listed |
| PHP | = 4.4.3 | No fix listed |
| PHP | = 4.4.4 | No fix listed |
| PHP | = 4.4.5 | No fix listed |
| PHP | = 4.4.6 | No fix listed |
| PHP | = 4.4.7 | No fix listed |
| PHP | = 4.4.8 | No fix listed |
| PHP | = 4.4.9 | No fix listed |
| PHP | = 5.0.0 | No fix listed |
| PHP | = 5.0.0-beta1 | No fix listed |
| PHP | = 5.0.0-beta2 | No fix listed |
Show 24 more
| Product | Affected versions | Fixed in |
|---|---|---|
| PHP | = 5.0.0-beta3 | No fix listed |
| PHP | = 5.0.0-beta4 | No fix listed |
| PHP | = 5.0.0-rc1 | No fix listed |
| PHP | = 5.0.0-rc2 | No fix listed |
| PHP | = 5.0.0-rc3 | No fix listed |
| PHP | = 5.0.1 | No fix listed |
| PHP | = 5.0.2 | No fix listed |
| PHP | = 5.0.3 | No fix listed |
| PHP | = 5.0.4 | No fix listed |
| PHP | = 5.0.5 | No fix listed |
| PHP | = 5.1.0 | No fix listed |
| PHP | = 5.1.1 | No fix listed |
| PHP | = 5.1.2 | No fix listed |
| PHP | = 5.1.3 | No fix listed |
| PHP | = 5.1.4 | No fix listed |
| PHP | = 5.1.5 | No fix listed |
| PHP | = 5.1.6 | No fix listed |
| PHP | = 5.2.0 | No fix listed |
| PHP | = 5.2.1 | No fix listed |
| PHP | = 5.2.2 | No fix listed |
| PHP | = 5.2.3 | No fix listed |
| PHP | = 5.2.4 | No fix listed |
| PHP | = 5.2.5 | No fix listed |
| PHP | = 5.2.6 | No fix listed |
References
- 20081221 CVE-2008-5557 - PHP mbstring buffer overflow mailing-list
- bugs.php.net exploit
- cvs.php.net exploit
- HPSBMA02492 vendor-advisory
- APPLE-SA-2009-05-12 vendor-advisory
- SUSE-SR:2009:004 vendor-advisory
- SUSE-SR:2009:008 vendor-advisory
- SSRT090085 vendor-advisory
- HPSBUX02465 vendor-advisory
- 34642 third-party-advisory
- 35003 third-party-advisory
- 35074 third-party-advisory
- 35306 third-party-advisory
- 35650 third-party-advisory
- 1021482 vdb-entry
- support.apple.com
- wiki.rpath.com
- DSA-1789 vendor-advisory
- MDVSA-2009:045 vendor-advisory
- www.php.net
- RHSA-2009:0350 vendor-advisory
- 20090302 rPSA-2009-0035-1 php php-cgi php-imap php-mcrypt php-mysql php-mysqli php-pgsql php-soap php-xsl php5 php5-cgi php5-imap php5-mcrypt php5-mysql php5-mysqli php5-pear php5-pgsql php5-soap php5-xsl mailing-list
- 32948 vdb-entry
- TA09-133A third-party-advisory us-government-resource
- ADV-2009-1297 vdb-entry
- php-multibyte-bo(47525) vdb-entry
- oval:org.mitre.oval:def:10286 signature vdb-entry
- FEDORA-2009-3768 vendor-advisory
- FEDORA-2009-3848 vendor-advisory