CVE-2010-3870

Published: Nov 12, 2010Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string.

Affected (7)

Products: Php: Php · Canonical: Ubuntu Linux

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Php Php	Before 5.2.14
Php Php	From 5.3.0 to 5.3.4

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 10.10
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 9.10

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (66)

http://bugs.php.net/bug.php?id=48230

Source: secalert@redhat.com

ExploitVendor Advisory

http://bugs.php.net/bug.php?id=49687

Source: secalert@redhat.com

ExploitVendor Advisory

http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052836.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052845.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=133469208622507&w=2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://secunia.com/advisories/42410

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/42812

Source: secalert@redhat.com

Third Party Advisory

http://sirdarckcat.blogspot.com/2009/10/couple-of-unicode-issues-on-php-and.html

Source: secalert@redhat.com

ExploitThird Party Advisory

http://support.apple.com/kb/HT4581

Source: secalert@redhat.com

Third Party Advisory

http://svn.php.net/viewvc?view=revision&revision=304959

Source: secalert@redhat.com

PatchVendor Advisory

http://us2.php.net/manual/en/function.utf8-decode.php#83935

Source: secalert@redhat.com

ExploitVendor Advisory

http://www.acunetix.com/blog/web-security-articles/security-risks-associated-with-utf8_decode/

Source: secalert@redhat.com

ExploitThird Party Advisory

http://www.blackhat.com/presentations/bh-usa-09/VELANAVA/BHUSA09-VelaNava-FavoriteXSS-SLIDES.pdf

Source: secalert@redhat.com

ExploitThird Party Advisory

http://www.mandriva.com/en/security/advisories?name=MDVSA-2010:224

Source: secalert@redhat.com

Third Party Advisory

http://www.openwall.com/lists/oss-security/2010/11/02/1

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2010/11/02/11

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2010/11/02/2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2010/11/02/4

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2010/11/02/6

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2010/11/02/8

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2010/11/03/1

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.php.net/ChangeLog-5.php

Source: secalert@redhat.com

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2010-0919.html

Source: secalert@redhat.com

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2011-0195.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/44605

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1024797

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-1042-1

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2010/3081

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2011/0020

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2011/0021

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2011/0077

Source: secalert@redhat.com

Third Party Advisory

http://bugs.php.net/bug.php?id=48230