CVE-2009-4142

2009-12-2100:00:00

ubuntu.com

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.02

Percentile

88.9%

JSON

The htmlspecialchars function in PHP before 5.2.12 does not properly handle
(1) overlong UTF-8 sequences, (2) invalid Shift_JIS sequences, and (3)
invalid EUC-JP sequences, which allows remote attackers to conduct
cross-site scripting (XSS) attacks by placing a crafted byte sequence
before a special character.

Bugs

OSVersionArchitecturePackageVersionFilename
ubuntu6.06noarchphp5< 5.1.2-1ubuntu3.18UNKNOWN
ubuntu8.04noarchphp5< 5.2.4-2ubuntu5.10UNKNOWN
ubuntu8.10noarchphp5< 5.2.6-2ubuntu4.6UNKNOWN
ubuntu9.04noarchphp5< 5.2.6.dfsg.1-3ubuntu4.5UNKNOWN
ubuntu9.10noarchphp5< 5.2.10.dfsg.1-2ubuntu6.4UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	6.06	noarch	php5	< 5.1.2-1ubuntu3.18	UNKNOWN
ubuntu	8.04	noarch	php5	< 5.2.4-2ubuntu5.10	UNKNOWN
ubuntu	8.10	noarch	php5	< 5.2.6-2ubuntu4.6	UNKNOWN
ubuntu	9.04	noarch	php5	< 5.2.6.dfsg.1-3ubuntu4.5	UNKNOWN
ubuntu	9.10	noarch	php5	< 5.2.10.dfsg.1-2ubuntu6.4	UNKNOWN