CVE-2010-1866

Executive Summary

Informations
Name	CVE-2010-1866	First vendor Publication	2010-05-07
Vendor	Cve	Last vendor Modification	2010-09-30

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score	7.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	10	Authentification	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The dechunk filter in PHP 5.3 through 5.3.2, when decoding an HTTP chunked encoding stream, allows context-dependent attackers to cause a denial of service (crash) and possibly trigger memory corruption via a negative chunk size, which bypasses a signed comparison, related to an integer overflow in the chunk size decoder.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1866

CWE : Common Weakness Enumeration

id	Name
CWE-189	Numeric Errors

CPE : Common Platform Enumeration

Type	Description	Count
Application	Php Php cpe:/a:php:php:5.3.2 cpe:/a:php:php:5.3.1 cpe:/a:php:php:5.3.0	3

Open Source Vulnerability Database (OSVDB)

id	Description
64527	PHP Dechunk Filter Negative Chunk Size Signed Comparison Bypass DoS

Internal Sources (Detail)

Source	Url
MISC	http://php-security.org/2010/05/02/mops-2010-003-php-dechunk-filter-signed-co...
SUSE	http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html