CVE-2010-4409: Integer Overflow
Published Dec 6, 2010
·Updated
Integer overflow in the NumberFormatter::getSymbol (aka numfmtgetsymbol) function in PHP 5.3.3 and earlier allows context-dependent attackers to cause a denial of service (application crash) via an invalid argument.
Affected Software
69 affected components
PHP PHP<=5.3.3
PHP PHP=1.0
PHP PHP=2.0
PHP PHP=2.0b10
PHP PHP=3.0
PHP PHP=3.0.1
PHP PHP=3.0.2
PHP PHP=3.0.3
PHP PHP=3.0.4
PHP PHP=3.0.5
PHP PHP=3.0.6
PHP PHP=3.0.7
PHP PHP=3.0.8
PHP PHP=3.0.9
PHP PHP=3.0.10
PHP PHP=3.0.11
PHP PHP=3.0.12
PHP PHP=3.0.13
PHP PHP=3.0.14
PHP PHP=3.0.15
PHP PHP=3.0.16
PHP PHP=3.0.17
PHP PHP=3.0.18
PHP PHP=4.0
PHP PHP=4.0-beta_4_patch1
PHP PHP=4.0-beta1
PHP PHP=4.0-beta2
PHP PHP=4.0-beta3
PHP PHP=4.0-beta4
PHP PHP=4.0.0
PHP PHP=4.0.1
PHP PHP=4.0.2
PHP PHP=4.0.3
PHP PHP=4.0.4
PHP PHP=4.0.5
PHP PHP=4.0.6
PHP PHP=4.0.7
PHP PHP=4.1.0
PHP PHP=4.1.1
PHP PHP=4.1.2
PHP PHP=4.2.0
PHP PHP=4.2.1
PHP PHP=4.2.2
PHP PHP=4.2.3
PHP PHP=4.3.0
PHP PHP=4.3.1
PHP PHP=4.3.2
PHP PHP=4.3.3
PHP PHP=4.3.4
PHP PHP=4.3.5
PHP PHP=4.3.6
PHP PHP=4.3.7
PHP PHP=4.3.8
PHP PHP=4.3.9
PHP PHP=4.3.10
PHP PHP=4.3.11
PHP PHP=4.4.0
PHP PHP=4.4.1
PHP PHP=4.4.2
PHP PHP=4.4.3
PHP PHP=4.4.4
PHP PHP=4.4.5
PHP PHP=4.4.6
PHP PHP=4.4.7
PHP PHP=4.4.8
PHP PHP=4.4.9
PHP PHP=5.3.0
PHP PHP=5.3.1
PHP PHP=5.3.2
Remediation
Patch Available
Event History
Dec 6, 2010
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2010-4409?
CVE-2010-4409 is classified as a denial of service vulnerability affecting PHP 5.3.3 and earlier versions.
2
How do I fix CVE-2010-4409?
To resolve CVE-2010-4409, upgrade to PHP version 5.3.4 or later, where the vulnerability is mitigated.
3
What causes CVE-2010-4409?
CVE-2010-4409 is caused by an integer overflow in the NumberFormatter::getSymbol function, allowing application crashes.
4
Which PHP versions are affected by CVE-2010-4409?
CVE-2010-4409 affects PHP versions 5.3.3 and earlier.
5
Can CVE-2010-4409 be exploited remotely?
Yes, CVE-2010-4409 can be exploited by context-dependent attackers through invalid arguments, potentially leading to denial of service.