Vulnerability Description
PHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary data sent to a script that processes user input in the html_entity_decode function and sends the encoded results back to the client, aka a "binary safety" issue. NOTE: this issue has been referred to as a "memory leak," but it is an information leak that discloses memory contents.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Php | Php | 3.0 |
References
- ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc
- http://bugs.gentoo.org/show_bug.cgi?id=127939
- http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/html.c?r1=1.112&r2=1.113Patch
- http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/html.c?view=log
- http://docs.info.apple.com/article.html?artnum=304829
- http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html
- http://rhn.redhat.com/errata/RHSA-2006-0276.html
- http://secunia.com/advisories/19383
- http://secunia.com/advisories/19499
- http://secunia.com/advisories/19570
- http://secunia.com/advisories/19832
- http://secunia.com/advisories/19979
- http://secunia.com/advisories/20052
- http://secunia.com/advisories/20210
- http://secunia.com/advisories/20951
FAQ
What is CVE-2006-1490?
CVE-2006-1490 is a vulnerability with a CVSS score of 5.0 (MEDIUM). PHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary data sent to a script that processes user input in the html_entity_decode function and sends the encod...
How severe is CVE-2006-1490?
CVE-2006-1490 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2006-1490?
Check the references section above for vendor advisories and patch information. Affected products include: Php Php.