CVE-2010-2101: Infoleak

Published May 27, 2010

Updated

The (1) striptags, (2) setcookie, (3) strtok, (4) wordwrap, (5) strwordcount, and (6) strpad functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

Affected Software

17 affected components

PHP PHP=5.2.9

PHP PHP=5.3.1

PHP PHP=5.2.7

PHP PHP=5.2.2

PHP PHP=5.2.5

PHP PHP=5.2.12

PHP PHP=5.2.11

PHP PHP=5.2.6

PHP PHP=5.3.0

PHP PHP=5.2.3

PHP PHP=5.2.13

PHP PHP=5.2.0

PHP PHP=5.2.4

PHP PHP=5.3.2

PHP PHP=5.2.10

PHP PHP=5.2.1

PHP PHP=5.2.8

Event History

May 27, 2010

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Data Sourced

via NVD·10:30 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2010-2101?

CVE-2010-2101 has been classified as a medium severity vulnerability affecting certain functions in PHP.

How do I fix CVE-2010-2101?

To fix CVE-2010-2101, upgrade PHP to version 5.3.3 or later, or ensure that you are using a patched version as identified in the security announcements.

What versions of PHP are affected by CVE-2010-2101?

CVE-2010-2101 affects PHP versions from 5.2.0 to 5.2.13 and from 5.3.0 to 5.3.2.

What types of attacks can exploit CVE-2010-2101?

CVE-2010-2101 can be exploited by context-dependent attackers to obtain sensitive information through a userspace interruption.

What functions in PHP are involved in CVE-2010-2101?

The functions involved in CVE-2010-2101 include strip_tags, setcookie, strtok, wordwrap, str_word_count, and str_pad.