CVE-2006-1490

PHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary data sent to a script that processes user input in the html_entity_decode function and sends the encoded results back to the client, aka a "binary safety" issue. NOTE: this issue has been referred to as a "memory leak," but it is an information leak that discloses memory contents.

CVSS v2.0 NVD

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

20.97% chance of exploitation in the next 30 days, 98th percentile

Published

2006-03-29

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/27508

Security advisories

• http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/html.c?r1=1.112&r2=1.113
• http://www.mandriva.com/security/advisories?name=MDKSA-2006:063
• http://www.securityfocus.com/bid/17296
• http://www.ubuntu.com/usn/usn-320-1

References

• CVE Record
• NVD entry