NVD Vulnerability Detail

CVE-2006-1490

Summary	PHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary data sent to a script that processes user input in the html_entity_decode function and sends the encoded results back to the client, aka a "binary safety" issue. NOTE: this issue has been referred to as a "memory leak," but it is an information leak that discloses memory contents.
Publication Date	March 30, 2006, 6:06 a.m.
Registration Date	Jan. 29, 2021, 3:34 p.m.
Last Update	Nov. 7, 2023, 10:58 a.m.

CVSS2.0 : MEDIUM
Score	5.0
Vector	AV:N/AC:L/Au:N/C:P/I:N/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	なし
可用性への影響(A)	なし
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:php:php:4.3.9:::::::*
cpe:2.3:a:php:php:3.0:::::::*
cpe:2.3:a:php:php:3.0.5:::::::*
cpe:2.3:a:php:php:3.0.11:::::::*
cpe:2.3:a:php:php:5.1.2:::::::*
cpe:2.3:a:php:php:4.2.0:::::::*
cpe:2.3:a:php:php:5.1.1:::::::*
cpe:2.3:a:php:php:3.0.1:::::::*
cpe:2.3:a:php:php:3.0.2:::::::*
cpe:2.3:a:php:php:5.0.0:beta1::::::
cpe:2.3:a:php:php:4.1.0:::::::*
cpe:2.3:a:php:php:4.3.4:::::::*
cpe:2.3:a:php:php:4.0.4:::::::*
cpe:2.3:a:php:php:4.3.0:::::::*
cpe:2.3:a:php:php:4.0.5:::::::*
cpe:2.3:a:php:php:5.0:rc1::::::
cpe:2.3:a:php:php:3.0.8:::::::*
cpe:2.3:a:php:php:5.0.5:::::::*
cpe:2.3:a:php:php:4.3.6:::::::*
cpe:2.3:a:php:php:3.0.13:::::::*
cpe:2.3:a:php:php:5.0.1:::::::*
cpe:2.3:a:php:php:4.0.7:rc2::::::
cpe:2.3:a:php:php:4.3.7:::::::*
cpe:2.3:a:php:php:5.0.4:::::::*
cpe:2.3:a:php:php:4.0.7:rc1::::::
cpe:2.3:a:php:php:4.2.2:::::::*
cpe:2.3:a:php:php:4.4.2:::::::*
cpe:2.3:a:php:php:3.0.7:::::::*
cpe:2.3:a:php:php:4.3.2:::::::*
cpe:2.3:a:php:php:4.3.11:::::::*
cpe:2.3:a:php:php:4.0.0:::::::*
cpe:2.3:a:php:php:3.0.6:::::::*
cpe:2.3:a:php:php:4.0.3:patch1::::::
cpe:2.3:a:php:php:3.0.17:::::::*
cpe:2.3:a:php:php:4.0.7:::::::*
cpe:2.3:a:php:php:4.0.2:::::::*
cpe:2.3:a:php:php:4.3.3:::::::*
cpe:2.3:a:php:php:5.0:rc3::::::
cpe:2.3:a:php:php:4.1.1:::::::*
cpe:2.3:a:php:php:3.0.15:::::::*
cpe:2.3:a:php:php:3.0.16:::::::*
cpe:2.3:a:php:php:5.0.0:rc2::::::
cpe:2.3:a:php:php:5.0.3:::::::*
cpe:2.3:a:php:php:3.0.10:::::::*
cpe:2.3:a:php:php:3.0.4:::::::*
cpe:2.3:a:php:php:4.2.3:::::::*
cpe:2.3:a:php:php:5.1.0:::::::*
cpe:2.3:a:php:php:4.0.1:patch1::::::
cpe:2.3:a:php:php:5.0.0:rc3::::::
cpe:2.3:a:php:php:4.0.1:patch2::::::
cpe:2.3:a:php:php:4.0.6:::::::*
cpe:2.3:a:php:php:5.0:rc2::::::
cpe:2.3:a:php:php:4.1.2:::::::*
cpe:2.3:a:php:php:5.0.0:beta3::::::
cpe:2.3:a:php:php:4.0.7:rc3::::::
cpe:2.3:a:php:php:4.3.1:::::::*
cpe:2.3:a:php:php:3.0.18:::::::*
cpe:2.3:a:php:php:4.4.0:::::::*
cpe:2.3:a:php:php:4.3.10:::::::*
cpe:2.3:a:php:php:4.2.1:::::::*
cpe:2.3:a:php:php:5.0.0:rc1::::::
cpe:2.3:a:php:php:4.0.1:::::::*
cpe:2.3:a:php:php:5.0.2:::::::*
cpe:2.3:a:php:php:3.0.12:::::::*
cpe:2.3:a:php:php:4.2::dev:::::
cpe:2.3:a:php:php:4.4.1:::::::*
cpe:2.3:a:php:php:4.0.3:::::::*
cpe:2.3:a:php:php:3.0.14:::::::*
cpe:2.3:a:php:php:3.0.9:::::::*
cpe:2.3:a:php:php:3.0.3:::::::*
cpe:2.3:a:php:php:5.0.0:beta4::::::
cpe:2.3:a:php:php:5.0.0:::::::*
cpe:2.3:a:php:php:4.3.8:::::::*
cpe:2.3:a:php:php:4.3.5:::::::*
cpe:2.3:a:php:php:5.0.0:beta2::::::

Related information, measures and tools

No	URL	refsource	タグ
1	http://bugs.gentoo.org/show_bug.cgi?id=127939	CONFIRM
2	http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/html.c?r1=1.112&r2=1.113	MISC	Patch
3	http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/html.c?view=log	MISC
4	http://www.securityfocus.com/bid/17296	BID
5	http://secunia.com/advisories/19383	SECUNIA
6	http://secunia.com/advisories/19499	SECUNIA
7	http://www.trustix.org/errata/2006/0020	TRUSTIX
8	http://secunia.com/advisories/19570	SECUNIA
9	http://rhn.redhat.com/errata/RHSA-2006-0276.html	REDHAT
10	http://secunia.com/advisories/19832	SECUNIA
11	http://www.novell.com/linux/security/advisories/05-05-2006.html	SUSE
12	http://security.gentoo.org/glsa/glsa-200605-08.xml	GENTOO
13	http://support.avaya.com/elmodocs2/security/ASA-2006-129.htm	CONFIRM
14	http://secunia.com/advisories/20951	SECUNIA
15	http://www.ubuntu.com/usn/usn-320-1	UBUNTU
16	http://docs.info.apple.com/article.html?artnum=304829	CONFIRM
17	http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html	APPLE
18	http://www.us-cert.gov/cas/techalerts/TA06-333A.html	CERT	US Government Resource
19	http://secunia.com/advisories/23155	SECUNIA
20	ftp://patches.sgi.com/support/free/security/advisories/20060501-01-U.asc	SGI
21	http://secunia.com/advisories/19979	SECUNIA
22	http://secunia.com/advisories/20052	SECUNIA
23	http://secunia.com/advisories/20210	SECUNIA
24	http://secunia.com/advisories/21125	SECUNIA
25	http://www.mandriva.com/security/advisories?name=MDKSA-2006:063	MANDRIVA
26	http://www.vupen.com/english/advisories/2006/1149	VUPEN
27	http://www.vupen.com/english/advisories/2006/4750	VUPEN
28	http://www.vupen.com/english/advisories/2006/2685	VUPEN
29	https://exchange.xforce.ibmcloud.com/vulnerabilities/25508	XF
30	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11084	OVAL
31	http://www.securityfocus.com/archive/1/429164/100/0/threaded	BUGTRAQ
32	http://www.securityfocus.com/archive/1/429162/100/0/threaded	BUGTRAQ

Common Vulnerabilities List

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:php:php:4.3.9:::::::*
cpe:2.3:a:php:php:3.0:::::::*
cpe:2.3:a:php:php:3.0.5:::::::*
cpe:2.3:a:php:php:3.0.11:::::::*
cpe:2.3:a:php:php:5.1.2:::::::*
cpe:2.3:a:php:php:4.2.0:::::::*
cpe:2.3:a:php:php:5.1.1:::::::*
cpe:2.3:a:php:php:3.0.1:::::::*
cpe:2.3:a:php:php:3.0.2:::::::*
cpe:2.3:a:php:php:5.0.0:beta1::::::
cpe:2.3:a:php:php:4.1.0:::::::*
cpe:2.3:a:php:php:4.3.4:::::::*
cpe:2.3:a:php:php:4.0.4:::::::*
cpe:2.3:a:php:php:4.3.0:::::::*
cpe:2.3:a:php:php:4.0.5:::::::*
cpe:2.3:a:php:php:5.0:rc1::::::
cpe:2.3:a:php:php:3.0.8:::::::*
cpe:2.3:a:php:php:5.0.5:::::::*
cpe:2.3:a:php:php:4.3.6:::::::*
cpe:2.3:a:php:php:3.0.13:::::::*
cpe:2.3:a:php:php:5.0.1:::::::*
cpe:2.3:a:php:php:4.0.7:rc2::::::
cpe:2.3:a:php:php:4.3.7:::::::*
cpe:2.3:a:php:php:5.0.4:::::::*
cpe:2.3:a:php:php:4.0.7:rc1::::::
cpe:2.3:a:php:php:4.2.2:::::::*
cpe:2.3:a:php:php:4.4.2:::::::*
cpe:2.3:a:php:php:3.0.7:::::::*
cpe:2.3:a:php:php:4.3.2:::::::*
cpe:2.3:a:php:php:4.3.11:::::::*
cpe:2.3:a:php:php:4.0.0:::::::*
cpe:2.3:a:php:php:3.0.6:::::::*
cpe:2.3:a:php:php:4.0.3:patch1::::::
cpe:2.3:a:php:php:3.0.17:::::::*
cpe:2.3:a:php:php:4.0.7:::::::*
cpe:2.3:a:php:php:4.0.2:::::::*
cpe:2.3:a:php:php:4.3.3:::::::*
cpe:2.3:a:php:php:5.0:rc3::::::
cpe:2.3:a:php:php:4.1.1:::::::*
cpe:2.3:a:php:php:3.0.15:::::::*
cpe:2.3:a:php:php:3.0.16:::::::*
cpe:2.3:a:php:php:5.0.0:rc2::::::
cpe:2.3:a:php:php:5.0.3:::::::*
cpe:2.3:a:php:php:3.0.10:::::::*
cpe:2.3:a:php:php:3.0.4:::::::*
cpe:2.3:a:php:php:4.2.3:::::::*
cpe:2.3:a:php:php:5.1.0:::::::*
cpe:2.3:a:php:php:4.0.1:patch1::::::
cpe:2.3:a:php:php:5.0.0:rc3::::::
cpe:2.3:a:php:php:4.0.1:patch2::::::
cpe:2.3:a:php:php:4.0.6:::::::*
cpe:2.3:a:php:php:5.0:rc2::::::
cpe:2.3:a:php:php:4.1.2:::::::*
cpe:2.3:a:php:php:5.0.0:beta3::::::
cpe:2.3:a:php:php:4.0.7:rc3::::::
cpe:2.3:a:php:php:4.3.1:::::::*
cpe:2.3:a:php:php:3.0.18:::::::*
cpe:2.3:a:php:php:4.4.0:::::::*
cpe:2.3:a:php:php:4.3.10:::::::*
cpe:2.3:a:php:php:4.2.1:::::::*
cpe:2.3:a:php:php:5.0.0:rc1::::::
cpe:2.3:a:php:php:4.0.1:::::::*
cpe:2.3:a:php:php:5.0.2:::::::*
cpe:2.3:a:php:php:3.0.12:::::::*
cpe:2.3:a:php:php:4.2::dev:::::
cpe:2.3:a:php:php:4.4.1:::::::*
cpe:2.3:a:php:php:4.0.3:::::::*
cpe:2.3:a:php:php:3.0.14:::::::*
cpe:2.3:a:php:php:3.0.9:::::::*
cpe:2.3:a:php:php:3.0.3:::::::*
cpe:2.3:a:php:php:5.0.0:beta4::::::
cpe:2.3:a:php:php:5.0.0:::::::*
cpe:2.3:a:php:php:4.3.8:::::::*
cpe:2.3:a:php:php:4.3.5:::::::*
cpe:2.3:a:php:php:5.0.0:beta2::::::