QwikSec

Security Database

CVE

CWE

Training

CVE-2008-5557

Published: Dec 23, 2008

Modified: Aug 7, 2024

PUBLISHED

Description

Heap-based buffer overflow in ext/mbstring/libmbfl/filters/mbfilter_htmlent.c in the mbstring extension in PHP 4.3.0 through 5.2.6 allows context-dependent attackers to execute arbitrary code via a crafted string containing an HTML entity, which is not properly handled during Unicode conversion, related to the (1) mb_convert_encoding, (2) mb_check_encoding, (3) mb_convert_variables, and (4) mb_parse_str functions.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

vendor-advisory

x_refsource_HP

http://support.apple.com/kb/HT3549

x_refsource_CONFIRM

vendor-advisory

x_refsource_HP

http://cvs.php.net/viewvc.cgi/php-src/ext/mbstring/libmbfl/filters/mbfilter_htmlent.c?r1=1.7&r2=1.8

x_refsource_CONFIRM

FEDORA-2009-3768

vendor-advisory

x_refsource_FEDORA

20090302 rPSA-2009-0035-1 php php-cgi php-imap php-mcrypt php-mysql php-mysqli php-pgsql php-soap php-xsl php5 php5-cgi php5-imap php5-mcrypt php5-mysql php5-mysqli php5-pear php5-pgsql php5-soap php5-xsl

mailing-list

x_refsource_BUGTRAQ

20081221 CVE-2008-5557 - PHP mbstring buffer overflow

mailing-list

x_refsource_FULLDISC

http://wiki.rpath.com/Advisories:rPSA-2009-0035

x_refsource_CONFIRM

third-party-advisory

x_refsource_SECUNIA

vdb-entry

x_refsource_SECTRACK

third-party-advisory

x_refsource_SECUNIA

vendor-advisory

x_refsource_HP

vendor-advisory

x_refsource_HP

APPLE-SA-2009-05-12

vendor-advisory

x_refsource_APPLE

SUSE-SR:2009:004

vendor-advisory

x_refsource_SUSE

SUSE-SR:2009:008

vendor-advisory

x_refsource_SUSE

vendor-advisory

x_refsource_REDHAT

FEDORA-2009-3848

vendor-advisory

x_refsource_FEDORA

third-party-advisory

x_refsource_SECUNIA

http://www.php.net/ChangeLog-5.php#5.2.7

x_refsource_CONFIRM

third-party-advisory

x_refsource_CERT

php-multibyte-bo(47525)

vdb-entry

x_refsource_XF

vendor-advisory

x_refsource_MANDRIVA

vdb-entry

x_refsource_VUPEN

vendor-advisory

x_refsource_HP

http://bugs.php.net/bug.php?id=45722

x_refsource_CONFIRM

oval:org.mitre.oval:def:10286

vdb-entry

signature

x_refsource_OVAL

third-party-advisory

x_refsource_SECUNIA

vendor-advisory

x_refsource_HP

third-party-advisory

x_refsource_SECUNIA

vdb-entry

x_refsource_BID

vendor-advisory

x_refsource_DEBIAN

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.