CVE-2009-4142: XSS

Q: What is the severity of CVE-2009-4142?

CVE-2009-4142 has been classified as a medium severity vulnerability that allows for cross-site scripting (XSS) attacks.

Q: How do I fix CVE-2009-4142?

To fix CVE-2009-4142, upgrade PHP to version 5.2.12 or later, which addresses the issue with the htmlspecialchars function.

Q: Which PHP versions are affected by CVE-2009-4142?

CVE-2009-4142 affects PHP versions prior to 5.2.12, including 4.x and early 5.x versions.

Q: What kind of attacks can CVE-2009-4142 facilitate?

CVE-2009-4142 can facilitate cross-site scripting (XSS) attacks, allowing attackers to inject malicious scripts into web pages.

Q: Is CVE-2009-4142 still a threat today?

While CVE-2009-4142 is an older vulnerability, systems running affected PHP versions remain at risk if not updated.

Published Dec 21, 2009

Updated

The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8 sequences, (2) invalid ShiftJIS sequences, and (3) invalid EUC-JP sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks by placing a crafted byte sequence before a special character.

Affected Software

111 affected components

PHP PHP=4.3.9

PHP PHP=4.4.9

PHP PHP=3.0

PHP PHP=5.2.9

PHP PHP=4.0-beta1

PHP PHP=3.0.5

PHP PHP=3.0.11

PHP PHP=5.1.5

PHP PHP=4.0-beta4

PHP PHP=4.2.0

PHP PHP=5.1.1

PHP PHP=3.0.1

PHP PHP=3.0.2

PHP PHP=4.4.4

PHP PHP=5.0.0-beta1

PHP PHP=4.1.0

PHP PHP=5.1.6

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=5.0-rc1

PHP PHP=5.2.2

PHP PHP=3.0.8

PHP PHP=5.0.5

PHP PHP=4.3.6

PHP PHP=3.0.13

PHP PHP=5.0.1

PHP PHP=4.0.7-rc4

PHP PHP=5.1.4

PHP PHP=5.2.5

PHP PHP=4.0.7-rc2

PHP PHP=4.3.7

PHP PHP=5.0.4

PHP PHP=4.0.7-rc1

PHP PHP=4.2.2

PHP PHP=4.4.2

PHP PHP=4.0-rc1

PHP PHP=3.0.7

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=3.0.6

PHP PHP=4.0.3-patch1

PHP PHP=3.0.17

PHP PHP=4.0.7

PHP PHP=4

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=5.0-rc3

PHP PHP=2.0

PHP PHP=4.1.1

PHP PHP=3.0.15

PHP PHP=3.0.16

PHP PHP=5.2.6

PHP PHP=4.4.3

PHP PHP=5.0.0-rc2

PHP PHP=5.2.3

PHP PHP=5.0.3

PHP PHP=3.0.10

PHP PHP=3.0.4

PHP PHP=4.2.3

PHP PHP=5.1.0

PHP PHP<=5.2.11

PHP PHP=4.4.5

PHP PHP=4.0.1-patch1

PHP PHP=5.0.0-rc3

PHP PHP=4.0

PHP PHP=4.0-beta2

PHP PHP=4.0.1-patch2

PHP PHP=2.0b10

PHP PHP=4.4.8

PHP PHP=4.0.6

PHP PHP=5.2.0

PHP PHP=5.0-rc2

PHP PHP=5.2.4

PHP PHP=4.1.2

PHP PHP=5.0.0-beta3

PHP PHP=4.0.7-rc3

PHP PHP=4.0-rc2

PHP PHP=4.3.1

PHP PHP=5.1.3

PHP PHP=3.0.18

PHP PHP=4.0-beta_4_patch1

PHP PHP=4.4.0

PHP PHP=5.2.10

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=5.0.0-rc1

PHP PHP=4.0.4-patch1

PHP PHP=4.0.1

PHP PHP=1.0

PHP PHP=5.0.2

PHP PHP=4.4.6

PHP PHP=3.0.12

PHP PHP=4.2

PHP PHP=4.4.1

PHP PHP=4.0-beta3

PHP PHP=5.2.1

PHP PHP=4.0.3

PHP PHP=3.0.14

PHP PHP=3.0.9

PHP PHP=3.0.3

PHP PHP=5.0.0-beta4

PHP PHP=5

PHP PHP=5.0.0

PHP PHP=4.3.8

PHP PHP=4.3.5

PHP PHP=5.0.0-beta2

PHP PHP=5.2.8

PHP PHP=4.4.7

Remediation

Patch Available

http://www.php.net/ChangeLog-5.php

Event History

Dec 21, 2009

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-4142?

CVE-2009-4142 has been classified as a medium severity vulnerability that allows for cross-site scripting (XSS) attacks.

How do I fix CVE-2009-4142?