CVE-2010-3870: Input Validation
The utf8decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3870?
CVE-2010-3870 is classified as a medium severity vulnerability due to its potential to allow attackers to bypass security mechanisms.
How do I fix CVE-2010-3870?
To fix CVE-2010-3870, upgrade PHP to version 5.3.4 or later, which addresses the issues with the utf8_decode function.
What systems are affected by CVE-2010-3870?
CVE-2010-3870 affects PHP versions prior to 5.3.4, as well as various Ubuntu Linux versions like 6.06 to 10.10.
What type of attacks can exploit CVE-2010-3870?
CVE-2010-3870 can be exploited through crafted strings that facilitate bypassing cross-site scripting (XSS) and SQL injection protections.
Is CVE-2010-3870 still a concern for modern applications?
While CVE-2010-3870 is an older vulnerability, legacy systems running the affected PHP versions may still be at risk.