vendor:
PHP
by:
cb
7,5
CVSS
HIGH
Off-by-one overflow
119
CWE
Product Name: PHP
Affected Version From: 5.3.3
Affected Version To: All versions
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2010
PHP 5.3.3 (Possible All versions) ibase_gen_id() off-by-one overflow
User-supplied variable 'generator' is copied to a 128 byte buffer 'query' which causes an off-by-one overflow. The vulnerable code is the snprintf statement which copies the 'generator' variable to the 'query' variable.
Mitigation:
Replace the vulnerable snprintf statement with a statement that limits the size of the 'query' variable to 127 bytes.
