CVE-2010-2100: Infoleak

Published May 27, 2010

Updated

The (1) htmlentities, (2) htmlspecialchars, (3) strgetcsv, (4) httpbuildquery, (5) strpbrk, and (6) strtr functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

Affected Software

17 affected components

PHP PHP=5.2.9

PHP PHP=5.3.1

PHP PHP=5.2.7

PHP PHP=5.2.2

PHP PHP=5.2.5

PHP PHP=5.2.12

PHP PHP=5.2.11

PHP PHP=5.2.6

PHP PHP=5.3.0

PHP PHP=5.2.3

PHP PHP=5.2.13

PHP PHP=5.2.0

PHP PHP=5.2.4

PHP PHP=5.3.2

PHP PHP=5.2.10

PHP PHP=5.2.1

PHP PHP=5.2.8

Event History

May 27, 2010

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Data Sourced

via NVD·10:30 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2010-2100?

CVE-2010-2100 is classified as a moderate severity vulnerability.

How do I fix CVE-2010-2100?

To fix CVE-2010-2100, upgrade PHP to version 5.2.14 or higher, or 5.3.3 or higher.

What software versions are affected by CVE-2010-2100?

The affected PHP versions include 5.2.0 through 5.2.13 and 5.3.0 through 5.3.2.

What type of attack does CVE-2010-2100 involve?

CVE-2010-2100 allows context-dependent attackers to obtain sensitive information through userspace interruption.

Is CVE-2010-2100 exploitable remotely?

CVE-2010-2100 is not necessarily exploitable remotely as it depends on context-specific conditions.