PHP "htmlspecialchars ()" Buffer Overflow Vulnerability

Release date:
Updated on:

Affected Systems:
PHP
Description:
--------------------------------------------------------------------------------
Bugtraq id: 51860

PHP is a script language running on a computer. It is mainly used to process dynamic web pages, including command line interfaces or graphical user interface programs.

PHP has a buffer overflow vulnerability in the implementation of the htmlspecialchars () function with $ double = false, because the starting position can only be 40 bytes, attackers can exploit this vulnerability to execute arbitrary code in the PHP process, cause the Web Server to crash, and deny service to legitimate users.

<* Source: cataphract

Link: https://bugs.php.net/bug.php? Id = 60965
*>

Test method:
--------------------------------------------------------------------------------
Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

<? Php
Echo
Htmlspecialchars ('""""""""""""""""""""""""""""""""""""" "& # renew; ',
ENT_QUOTES, 'utf-8', false), "\ n ";

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

PHP
---
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.php.net