note 71268 deleted from function.html-entity-decode by nlopess
| From: | nlopess@php.net | Date: | Sat, 20 Jan 2007 22:35:41 +0000 |
| Subject: | note 71268 deleted from function.html-entity-decode by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-121968@lists.php.net to get a copy of this message | ||
Note Submitter: Beat
----
You should be aware that this function has a severe security bug in it in unpatched php versions
< 4.4.3 and < 5.1.3. On those systems, it it should not be used to process user inputs.
For broad systems usage (lots of hosters don't have this patch or up-to-date versions yet), it
should not be used to process user inputs, as it can provide (and i've seen this) exposure of
random (actually not so random, since it's recently used content in memory !) memory content,
related to your website (like private pages just generated, like source code, passwords etc).
Reference: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1490