CVE-2010-3717: Medium severity typo3 vulnerability

Published Oct 25, 2010

Updated

The t3libdiv::validEmail function in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly restrict input to filtervar FILTERVALIDATEEMAIL operations in PHP, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a long e-mail address string, a related issue to CVE-2010-3710.

Affected Software

26 affected components

Typo3 TYPO3=4.2.10

Typo3 TYPO3=4.3.6

Typo3 TYPO3=4.2.14

Typo3 TYPO3=4.3.5

Typo3 TYPO3=4.2.4

Typo3 TYPO3=4.2.5

Typo3 TYPO3=4.2.11

Typo3 TYPO3=4.2.0

Typo3 TYPO3=4.2.8

Typo3 TYPO3=4.2.13

Typo3 TYPO3=4.2.3

Typo3 TYPO3=4.2.1

Typo3 TYPO3=4.3.2

Typo3 TYPO3=4.4.1

Typo3 TYPO3=4.4.2

Typo3 TYPO3=4.2.12

Typo3 TYPO3=4.2.6

Typo3 TYPO3=4.3.0

Typo3 TYPO3=4.2.2

Typo3 TYPO3=4.3.3

Typo3 TYPO3=4.3.4

Typo3 TYPO3=4.4

Typo3 TYPO3=4.3.1

Typo3 TYPO3=4.2.7

Typo3 TYPO3=4.4.3

Typo3 TYPO3=4.2.9

Event History

Oct 25, 2010

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-3717?

CVE-2010-3717 has been classified as a medium severity vulnerability due to the potential for denial of service.

How do I fix CVE-2010-3717?

To remediate CVE-2010-3717, upgrade to TYPO3 versions 4.2.15, 4.3.7, or 4.4.4 and later.

Which TYPO3 versions are affected by CVE-2010-3717?

CVE-2010-3717 affects TYPO3 versions 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4.

What kind of attack does CVE-2010-3717 enable?

CVE-2010-3717 enables remote attackers to cause denial of service via memory consumption and application crashes.

Where can I find more details about CVE-2010-3717?

Details about CVE-2010-3717 can be found in the TYPO3 security bulletins and related security databases.