Host Impact: Denial of Service.
Execution of arbitrary code.
Summary: Some vulnerabilities have been reported in PHP, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a vulnerable system.
Fix Type: Update the software.
Copyright: Stefan Esser
Published Date: March 16, 2007
Description: Some vulnerabilities have been reported in PHP, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially compromise a vulnerable system.
The vulnerabilities are caused due to boundary errors within the "htmlentities()" and "htmlspecialchars()" functions. If a PHP application uses these functions to process user-supplied input, this can be exploited to cause a heap-based buffer overflow by passing specially crafted data to the affected application.
Successful exploitation may allow execution of arbitrary code, but requires that the UTF-8 character set is selected.
The vulnerability is confirmed in version 5.x < 5.2.0 and also reported in version 4.4.6. Other versions may also be affected.