PT-2019-6208 · Libxml2+1 · Libxml2+1
Kees Cook
·
Publicado
2019-11-13
·
Atualizado
2019-11-20
·
CVE-2010-4657
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
PHP versions prior to 5.4.4
Description
The issue is related to the XMLWriter component in PHP, where a memory leak occurs due to the failure to release resources after their expiration. This can be exploited by a remote attacker to disclose protected information. Specifically, passing invalid UTF-8 strings via the
xmlTextWriterWriteAttribute function can cause libxml2 to misparse them, resulting in a memory leak in the output.Recommendations
For versions prior to 5.4.4, update to version 5.4.4 or later to resolve the issue.
As a temporary workaround, consider restricting the use of the
xmlTextWriterWriteAttribute function to minimize the risk of exploitation.Correção
Missing Release of Resource after Effective Lifetime
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Php
Libxml2