CVE-2010-2190: Infoleak

Published Jun 7, 2010

Updated

The (1) trim, (2) ltrim, (3) rtrim, and (4) substrreplace functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

Affected Software

17 affected components

PHP PHP=5.2.9

PHP PHP=5.3.1

PHP PHP=5.2.7

PHP PHP=5.2.2

PHP PHP=5.2.5

PHP PHP=5.2.12

PHP PHP=5.2.11

PHP PHP=5.2.6

PHP PHP=5.3.0

PHP PHP=5.2.3

PHP PHP=5.2.13

PHP PHP=5.2.0

PHP PHP=5.2.4

PHP PHP=5.3.2

PHP PHP=5.2.10

PHP PHP=5.2.1

PHP PHP=5.2.8

Event History

Jun 7, 2010

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Jun 8, 2010

Data Sourced

via NVD·12:30 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2010-2190?

CVE-2010-2190 is classified as a medium severity vulnerability that can lead to information disclosure.

How do I fix CVE-2010-2190?

To fix CVE-2010-2190, upgrade PHP to version 5.2.14 or higher, or 5.3.3 or higher.

What versions of PHP are affected by CVE-2010-2190?

CVE-2010-2190 affects PHP versions 5.2.0 through 5.2.13 and 5.3.0 through 5.3.2.

What type of attack does CVE-2010-2190 enable?

CVE-2010-2190 enables context-dependent attackers to obtain sensitive information from memory contents.

Is CVE-2010-2190 still a concern for PHP users?

Yes, users running the affected versions of PHP should be concerned if they have not yet upgraded to secure versions.