SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   PHP Vendors:   PHP Group
PHP Buffer Overflows in htmlspecialchars() and htmlentities() May Let Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1017152
SecurityTracker URL:  http://securitytracker.com/id/1017152
CVE Reference:   CVE-2006-5465   (Links to External Site)
Date:  Nov 2 2006
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 5.2.0
Description:   A vulnerability was reported in PHP. A remote user may be able to execute arbitrary code on the target system.

The underlying code in the htmlspecialchars() and htmlentities() functions contains a buffer overflow. A remote user can supply specially crafted data to an application that uses the affected functions to potentially execute arbitrary code.

Stefan Esser discovered this vulnerability.

Impact:   A remote user may be able to execute arbitrary code on the target system.
Solution:   The vendor has issued a fixed version (5.2.0), available at:

http://www.php.net/downloads.php

The PHP advisory is available at:

http://www.php.net/releases/5_2_0.php

Vendor URL:  www.php.net/releases/5_2_0.php (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Nov 6 2006 (Red Hat Issues Fix) PHP Buffer Overflows in htmlspecialchars() and htmlentities() May Let Remote Users Execute Arbitrary Code
Red Hat has released a fix for Red Hat Enterprise Linux 2.1, 3, and 4.
Nov 10 2006 (Red Hat Issues Fix for Red Hat Application Stack) PHP Buffer Overflows in htmlspecialchars() and htmlentities() May Let Remote Users Execute Arbitrary Code
Red Hat has released a fix for Red Hat Application Stack for Enterprise Linux version 4.
Nov 29 2006 (Apple Issues Fix) PHP Buffer Overflows in htmlspecialchars() and htmlentities() May Let Remote Users Execute Arbitrary Code
Apple has released a fix for Mac OS X.
Dec 11 2006 (Red Hat Issues Fix for Stronghold) PHP Buffer Overflows in htmlspecialchars() and htmlentities() May Let Remote Users Execute Arbitrary Code
Red Hat has issued a fix for Red Hat Stronghold 4.0 for Enterprise Linux.



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC