CVE-2010-4156

Advisory lineage Upstream: 0 Downstream: 1

Downstream

RHSA-2011:0196

Modified

Published: 10 Nov 2010, 01:00

Last modified:07 Aug 2024, 03:34

Vulnerability Summary

Overall Risk (default)

medium

32/100

CVSS Score

5 MEDIUM

v2.0 (nvd)

EPSS Score

10.11% MEDIUM

10% probability 0.00%

KEV

Not listed

Ransomware

No reports

Public exploits

4 found

Dark Web

Not detected

Timeline

10 Nov 2010, 01:00

Published

Vulnerability first disclosed

07 Aug 2024, 03:34

Last Modified

Vulnerability information updated

Description

The mb_strcut function in Libmbfl 1.1.0, as used in PHP 5.3.x through 5.3.3, allows context-dependent attackers to obtain potentially sensitive information via a large value of the third parameter (aka the length parameter).

CVSS Metrics

v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 10.11%• Percentile: 93%

Techniques & Countermeasures

CWE-20•Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected Systems

scottmac•libmbfl
1.1.0