CVE-2004-0595 | BDVDB-2026-6618 Detail
Description#
The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\0) characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and facilitate the exploitation of cross-site scripting (XSS) vulnerabilities.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000847
- http://marc.info/?l=bugtraq&m=108982983426031&w=2
- http://www.debian.org/security/2005/dsa-669
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10619
- http://www.redhat.com/support/errata/RHSA-2004-395.html
- http://www.redhat.com/support/errata/RHSA-2004-405.html
- http://www.redhat.com/support/errata/RHSA-2004-392.html
- http://www.debian.org/security/2004/dsa-531
- http://www.novell.com/linux/security/advisories/2004_21_php4.html
- http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:068
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16692
- http://www.redhat.com/support/errata/RHSA-2005-816.html
- http://marc.info/?l=bugtraq&m=109181600614477&w=2
- http://marc.info/?l=bugtraq&m=109051444105182&w=2
- http://www.securityfocus.com/bid/10724
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.