CVE-2009-5016 Integer overflow in n/a
Remote attackers can bypass XSS and SQL injection protections in PHP's XML extension via crafted overlong UTF-8 strings exploiting an integer overflow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-5016?
CVE-2009-5016 is a medium-severity vulnerability in Php Php, published on 12 Nov 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Integer overflow in the xml_utf8_decode function in ext/xml/xml.c in PHP before 5.2.11 makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string that uses overlong UTF-8 encoding, a different vulnerability than CVE-2010-3870.
Weakness: CWE-189
Which versions are affected by CVE-2009-5016?
It affects 1 product.
Products include Php Php.
How do I fix CVE-2009-5016?
Upgrade to a fixed version.
Is CVE-2009-5016 being exploited?
There is no known exploitation of CVE-2009-5016 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as GHSA-8fg6-84xm-jg65.