CVE-2010-4156: Input Validation
Published Nov 10, 2010
·Updated
The mbstrcut function in Libmbfl 1.1.0, as used in PHP 5.3.x through 5.3.3, allows context-dependent attackers to obtain potentially sensitive information via a large value of the third parameter (aka the length parameter).
Affected Software
5 affected components
PHP PHP=5.3.0
PHP PHP=5.3.1
PHP PHP=5.3.2
PHP PHP=5.3.3
Scottmac Libmbfl=1.1.0
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Nov 10, 2010
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Data Sourced
03:00 AM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2010-4156?
CVE-2010-4156 has not been assigned a severity score but can potentially lead to information disclosure.
2
How do I fix CVE-2010-4156?
To fix CVE-2010-4156, upgrade Libmbfl to a version higher than 1.1.0.
3
Which versions are affected by CVE-2010-4156?
CVE-2010-4156 specifically affects Libmbfl version 1.1.0.
4
What kind of attack does CVE-2010-4156 allow?
CVE-2010-4156 allows context-dependent attackers to obtain potentially sensitive information.
5
Is CVE-2010-4156 related to PHP versions?
CVE-2010-4156 involves Libmbfl but is used in PHP versions 5.3.0 through 5.3.3, which are not vulnerable themselves.