CVE-2009-4142
The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8...
4.3 MediumPublic exploit
CVE-2009-4142 is a medium vulnerability (CVSS 4.3) in Php, published December 21, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.50%, the 93rd percentile. No source names a fixed version.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 6.50%EPSS, 93rd percentile
- Exploitation
- None known2 public exploits
- Fixed in
- No fix listedNo source names one
Description
The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8 sequences, (2) invalid Shift_JIS sequences, and (3) invalid EUC-JP sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks by placing a crafted byte sequence before a special character.
Exploit likelihood
6.50%Down 5.8 points since Feb 4, 2022
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
php5Debian:5.0 From an advisory covering 2 CVEs | before 5.2.6.dfsg.1-1+lenny6, plus listed versions 5.2.6.dfsg.1-1+lenny25.2.6.dfsg.1-1+lenny35.2.6.dfsg.1-1+lenny4 | 5.2.6.dfsg.1-1+lenny6 |
phpRed Hat:enterprise_linux:3::as From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-develRed Hat:enterprise_linux:3::as From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-imapRed Hat:enterprise_linux:3::as From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-ldapRed Hat:enterprise_linux:3::as From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-mysqlRed Hat:enterprise_linux:3::as From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-odbcRed Hat:enterprise_linux:3::as From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-pgsqlRed Hat:enterprise_linux:3::as From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
phpRed Hat:enterprise_linux:3::desktop From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
Show 123 moreShow less
| Package | Affected | Fixed |
|---|---|---|
php-debuginfoRed Hat:enterprise_linux:3::desktop From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-develRed Hat:enterprise_linux:3::desktop From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-imapRed Hat:enterprise_linux:3::desktop From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-ldapRed Hat:enterprise_linux:3::desktop From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-mysqlRed Hat:enterprise_linux:3::desktop From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-odbcRed Hat:enterprise_linux:3::desktop From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-pgsqlRed Hat:enterprise_linux:3::desktop From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
phpRed Hat:enterprise_linux:3::es From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-develRed Hat:enterprise_linux:3::es From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-imapRed Hat:enterprise_linux:3::es From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-ldapRed Hat:enterprise_linux:3::es From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-mysqlRed Hat:enterprise_linux:3::es From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-odbcRed Hat:enterprise_linux:3::es From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-pgsqlRed Hat:enterprise_linux:3::es From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
phpRed Hat:enterprise_linux:3::ws From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-debuginfoRed Hat:enterprise_linux:3::ws From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-develRed Hat:enterprise_linux:3::ws From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-imapRed Hat:enterprise_linux:3::ws From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-ldapRed Hat:enterprise_linux:3::ws From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-mysqlRed Hat:enterprise_linux:3::ws From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-odbcRed Hat:enterprise_linux:3::ws From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
php-pgsqlRed Hat:enterprise_linux:3::ws From an advisory covering 6 CVEs | before 0:4.3.2-54.ent | 0:4.3.2-54.ent |
phpRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-develRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-domxmlRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-gdRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-imapRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-ldapRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-mbstringRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-mysqlRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-ncursesRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-odbcRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-pearRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-pgsqlRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-snmpRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-xmlrpcRed Hat:enterprise_linux:4::as From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
phpRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-develRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-domxmlRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-gdRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-imapRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-ldapRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-mbstringRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-mysqlRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-ncursesRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-odbcRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-pearRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-pgsqlRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-snmpRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-xmlrpcRed Hat:enterprise_linux:4::desktop From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
phpRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-develRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-domxmlRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-gdRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-imapRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-ldapRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-mbstringRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-mysqlRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-ncursesRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-odbcRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-pearRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-pgsqlRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-snmpRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-xmlrpcRed Hat:enterprise_linux:4::es From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
phpRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-develRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-domxmlRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-gdRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-imapRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-ldapRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-mbstringRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-mysqlRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-ncursesRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-odbcRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-pearRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-pgsqlRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-snmpRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
php-xmlrpcRed Hat:enterprise_linux:4::ws From an advisory covering 6 CVEs | before 0:4.3.9-3.29 | 0:4.3.9-3.29 |
phpRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-bcmathRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-cliRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-commonRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-dbaRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-gdRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-imapRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-ldapRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-mbstringRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-mysqlRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-ncursesRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-odbcRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-pdoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-pgsqlRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-snmpRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-soapRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-xmlRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-xmlrpcRed Hat:enterprise_linux:5::client_workstation From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
phpRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-bcmathRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-cliRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-commonRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-dbaRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-develRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-gdRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-imapRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-ldapRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-mbstringRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-mysqlRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-ncursesRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-odbcRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-pdoRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-pgsqlRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-snmpRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-soapRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-xmlRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
php-xmlrpcRed Hat:enterprise_linux:5::server From an advisory covering 6 CVEs | before 0:5.1.6-24.el5_4.5 | 0:5.1.6-24.el5_4.5 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | PHP 5.2.11 - 'htmlspecialCharacters()' Malformed Multibyte Character Cross-Site Scripting (1) | 2009-12-17 |
| Exploit-DB | PHP 5.2.11 - 'htmlspecialCharacters()' Malformed Multibyte Character Cross-Site Scripting (2) | 2009-12-17 |
What each source reports
NVD Score used
The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8 sequences, (2) invalid Shift_JIS sequences, and (3) invalid EUC-JP sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks by placing a crafted byte sequence before a special character.
- Record
CVE-2009-4142- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8 sequences, (2) invalid Shift_JIS sequences, and (3) invalid EUC-JP sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks by placing a crafted byte sequence before a special character.
- Record
CVE-2009-4142- Updated
- 2026-11-02
EUVDEUVD-2009-4112No score
The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8 sequences, (2) invalid Shift_JIS sequences, and (3) invalid EUC-JP sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks by placing a crafted byte sequence before a special character.
- Record
EUVD-2009-4112- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q555-wmm9-43g3No score
The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8...
The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8 sequences, (2) invalid Shift_JIS sequences, and (3) invalid EUC-JP sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks by placing a crafted byte sequence before a special character.
- Record
GHSA-q555-wmm9-43g3- Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securityfocus.com/bid/37389
php.net/releases/5_2_12.php
bugs.php.net/bug.php?id=49785
secunia.com/advisories/40262
marc.info?l=bugtraq&m=127680701405735&w=2
securitytracker.com/id?1023372
Show 37 moreShow less
lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7085
support.apple.com/kb/HT4077
vupen.com/english/advisories/2009/3593
debian.org/security/2010/dsa-2001
nvd.nist.gov/vuln/detail/CVE-2009-4142
github.com/advisories/GHSA-q555-wmm9-43g3
access.redhat.com/errata/RHSA-2010:0040
bugzilla.redhat.com/show_bug.cgi?id=506896
security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0040.json
cve.org/CVERecord?id=CVE-2009-2687