SB2010121004 - Multiple vulnerabilities in PHP 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2010121004

SB2010121004 - Multiple vulnerabilities in PHP

Published: December 10, 2010 Updated: June 12, 2025

Security Bulletin ID SB2010121004
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Cryptographic issues (CVE-ID: CVE-2010-1128)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function.


2) Input validation error (CVE-ID: CVE-2009-4418)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The unserialize function in PHP 5.3.0 and earlier allows context-dependent attackers to cause a denial of service (resource consumption) via a deeply nested serialized variable, as demonstrated by a string beginning with a:1: followed by many {a:1: sequences.


Remediation

Install update from vendor's website.

References