CVE-2010-1864: Infoleak
Published May 7, 2010
·Updated
The addcslashes function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.
Affected Software
16 affected components
PHP PHP=5.2.9
PHP PHP=5.2.2
PHP PHP=5.2.5
PHP PHP=5.2.12
PHP PHP=5.2.11
PHP PHP=5.2.6
PHP PHP=5.2.3
PHP PHP=5.2.13
PHP PHP=5.2.0
PHP PHP=5.2.4
PHP PHP=5.2.10
PHP PHP=5.2.1
PHP PHP=5.2.8
PHP PHP=5.3.1
PHP PHP=5.3.0
PHP PHP=5.3.2
Event History
May 7, 2010
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Data Sourced
via NVD·11:00 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2010-1864?
CVE-2010-1864 has a medium severity level due to its potential to leak sensitive information.
2
How do I fix CVE-2010-1864?
To fix CVE-2010-1864, upgrade PHP to version 5.2.14 or higher for 5.2.x series, or version 5.3.3 or higher for 5.3.x series.
3
What versions of PHP are affected by CVE-2010-1864?
CVE-2010-1864 affects PHP versions 5.2.0 to 5.2.13 and 5.3.0 to 5.3.2.
4
What kind of attack can exploit CVE-2010-1864?
CVE-2010-1864 can be exploited by context-dependent attackers to obtain sensitive memory contents.
5
Is CVE-2010-1864 related to a specific PHP function?
Yes, CVE-2010-1864 specifically involves the addcslashes function in PHP.