PHP filtering extension multiple security vulnerabilities
Published:		14.03.2007
Source:		PHP-SECURITY
SecurityVulns ID:		7399
Type:		remote
Level:		5/10
Description:		Buffer underflow, filtering protection bypass.

Affected:		PHP : PHP 5.2
CVE:		CVE-2007-1454 (ext/filter in PHP 5.2.0, when FILTER_SANITIZE_STRING is used with the FILTER_FLAG_STRIP_LOW flag, does not properly strip HTML tags, which allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML with a '<' character followed by certain whitespace characters, which passes one filter but is collapsed into a valid tag, as demonstrated using %0b.)
		CVE-2007-1453 (Buffer underflow in the PHP_FILTER_TRIM_DEFAULT macro in the filtering extension (ext/filter) in PHP 5.2.0 allows context-dependent attackers to execute arbitrary code by calling filter_var with certain modes such as FILTER_VALIDATE_INT, which causes filter to write a null byte in whitespace that precedes the buffer.)

Original document		PHP-SECURITY, MOPB-19-2007:PHP ext/filter Space Trimming Buffer Underflow Vulnerability (14.03.2007)
		PHP-SECURITY, MOPB-18-2007:PHP ext/filter HTML Tag Stripping Bypass Vulnerability (14.03.2007)

Files:		PHP ext/filter Space Trimming Buffer Underflow Vulnerability
Discuss:		Read or add your comments to this news (0 comments)