CVE-2009-5016: XSS

Q: What is the severity of CVE-2009-5016?

CVE-2009-5016 is considered a medium severity vulnerability due to its potential to bypass security mechanisms like XSS and SQL injection protections.

Q: How do I fix CVE-2009-5016?

To mitigate CVE-2009-5016, it is recommended to upgrade PHP to version 5.2.11 or later, as earlier versions are affected by this vulnerability.

Q: Which PHP versions are affected by CVE-2009-5016?

CVE-2009-5016 affects PHP versions 3.0 through 5.2.10, including various 4.x and 5.x beta versions.

Q: What type of attack does CVE-2009-5016 facilitate?

CVE-2009-5016 facilitates attacks that allow remote attackers to bypass XSS and SQL injection protection using crafted strings with overlong UTF-8 encoding.

Q: Is CVE-2009-5016 related to any other vulnerabilities?

Yes, CVE-2009-5016 is a different vulnerability from CVE-2010-387, although both involve issues with PHP's handling of certain encoded strings.

Published Nov 12, 2010

Updated

Integer overflow in the xmlutf8decode function in ext/xml/xml.c in PHP before 5.2.11 makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string that uses overlong UTF-8 encoding, a different vulnerability than CVE-2010-3870.

Affected Software

88 affected components

PHP PHP=4.3.9

PHP PHP=4.4.9

PHP PHP=3.0

PHP PHP=4.0-beta1

PHP PHP=3.0.5

PHP PHP=3.0.11

PHP PHP=5.1.5

PHP PHP=5.1.2

PHP PHP=4.0-beta4

PHP PHP=4.2.0

PHP PHP=5.1.1

PHP PHP=3.0.1

PHP PHP=3.0.2

PHP PHP=4.4.4

PHP PHP=5.0.0-beta1

PHP PHP=4.1.0

PHP PHP=5.1.6

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=3.0.8

PHP PHP=5.0.5

PHP PHP=4.3.6

PHP PHP=3.0.13

PHP PHP=5.0.1

PHP PHP=5.1.4

PHP PHP=4.3.7

PHP PHP=5.0.4

PHP PHP=4.2.2

PHP PHP<=5.2.10

PHP PHP=4.4.2

PHP PHP=3.0.7

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=3.0.6

PHP PHP=3.0.17

PHP PHP=4.0.7

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=2.0

PHP PHP=4.1.1

PHP PHP=3.0.15

PHP PHP=3.0.16

PHP PHP=4.4.3

PHP PHP=5.0.0-rc2

PHP PHP=5.0.3

PHP PHP=3.0.10

PHP PHP=3.0.4

PHP PHP=4.2.3

PHP PHP=5.1.0

PHP PHP=4.4.5

PHP PHP=5.0.0-rc3

PHP PHP=4.0

PHP PHP=4.0-beta2

PHP PHP=2.0b10

PHP PHP=4.4.8

PHP PHP=4.0.6

PHP PHP=5.2.0

PHP PHP=4.1.2

PHP PHP=5.0.0-beta3

PHP PHP=4.3.1

PHP PHP=5.1.3

PHP PHP=3.0.18

PHP PHP=4.0-beta_4_patch1

PHP PHP=4.4.0

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=5.0.0-rc1

PHP PHP=4.0.1

PHP PHP=1.0

PHP PHP=5.0.2

PHP PHP=4.4.6

PHP PHP=3.0.12

PHP PHP=4.4.1

PHP PHP=4.0-beta3

PHP PHP=5.2.1

PHP PHP=4.0.3

PHP PHP=3.0.14

PHP PHP=3.0.9

PHP PHP=3.0.3

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0

PHP PHP=4.3.8

PHP PHP=4.3.5

PHP PHP=5.0.0-beta2

PHP PHP=4.4.7

Event History

Nov 12, 2010

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-5016?

CVE-2009-5016 is considered a medium severity vulnerability due to its potential to bypass security mechanisms like XSS and SQL injection protections.

How do I fix CVE-2009-5016?

To mitigate CVE-2009-5016, it is recommended to upgrade PHP to version 5.2.11 or later, as earlier versions are affected by this vulnerability.

Which PHP versions are affected by CVE-2009-5016?