CVE-2010-4645 - strtod.c, as used in the zend_strtod function in PHP 5.2 before 5.2.17 and 5.3 before 5.3.5, and oth

CVE-2010-4645

Summary

strtod.c, as used in the zend_strtod function in PHP 5.2 before 5.2.17 and 5.3 before 5.3.5, and other products, allows context-dependent attackers to cause a denial of service (infinite loop) via a certain floating-point value in scientific notation, which is not properly handled in x87 FPU registers, as demonstrated using 2.2250738585072011e-308.

References

Vulnerable Configurations

cpe:2.3:a:php:php:5.2.9:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.9:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.14:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.14:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.16:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.16:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.7:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.7:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.5:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.5:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.12:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.12:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.11:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.11:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.6:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.6:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.13:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.13:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.4:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.4:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.10:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.10:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.15:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.15:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.8:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.8:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.4:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.3.4:*:*:*:*:*:*:*

CVSS

Base:	5.0 (as of 15-05-2023 - 00:15)
Impact:
Exploitability:

CWE

CWE-189

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:N/I:N/A:P

redhat via4

advisories

bugzilla

id	667806
title	CVE-2010-4645 php: hang on numeric value 2.2250738585072011e-308 with x87 fpu

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 6 is installed
oval oval:com.redhat.rhba:tst:20111656003

AND
comment php is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195001
comment php is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195002
AND
comment php-bcmath is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195003
comment php-bcmath is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195004
AND
comment php-cli is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195005
comment php-cli is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195006
AND
comment php-common is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195007
comment php-common is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195008
AND
comment php-dba is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195009
comment php-dba is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195010
AND
comment php-devel is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195011
comment php-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195012

AND

comment php-embedded is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195013
comment php-embedded is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195014

AND
comment php-enchant is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195015
comment php-enchant is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195016
AND
comment php-gd is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195017
comment php-gd is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195018
AND
comment php-imap is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195019
comment php-imap is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195020
AND
comment php-intl is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195021
comment php-intl is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195022
AND
comment php-ldap is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195023
comment php-ldap is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195024

AND

comment php-mbstring is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195025
comment php-mbstring is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195026

AND
comment php-mysql is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195027
comment php-mysql is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195028
AND
comment php-odbc is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195029
comment php-odbc is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195030
AND
comment php-pdo is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195031
comment php-pdo is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195032
AND
comment php-pgsql is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195033
comment php-pgsql is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195034
AND
comment php-process is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195035
comment php-process is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195036
AND
comment php-pspell is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195037
comment php-pspell is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195038
AND
comment php-recode is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195039
comment php-recode is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195040
AND
comment php-snmp is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195041
comment php-snmp is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195042
AND
comment php-soap is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195043
comment php-soap is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195044
AND
comment php-tidy is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195045
comment php-tidy is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195046
AND
comment php-xml is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195047
comment php-xml is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195048
AND
comment php-xmlrpc is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195049
comment php-xmlrpc is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195050
AND
comment php-zts is earlier than 0:5.3.2-6.el6_0.1
oval oval:com.redhat.rhsa:tst:20110195051
comment php-zts is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195052

rhsa

id	RHSA-2011:0195
released	2011-02-03
severity	Moderate
title	SA-2011:0195: php security update (Moderate)

bugzilla

id	667806
title	CVE-2010-4645 php: hang on numeric value 2.2250738585072011e-308 with x87 fpu

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 5 is installed
oval oval:com.redhat.rhba:tst:20070331005

AND
comment php53 is earlier than 0:5.3.3-1.el5_6.1
oval oval:com.redhat.rhsa:tst:20110196001
comment php53 is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196002
AND
comment php53-bcmath is earlier than 0:5.3.3-1.el5_6.1
oval oval:com.redhat.rhsa:tst:20110196003
comment php53-bcmath is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196004
AND
comment php53-cli is earlier than 0:5.3.3-1.el5_6.1
oval oval:com.redhat.rhsa:tst:20110196005
comment php53-cli is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196006
AND
comment php53-common is earlier than 0:5.3.3-1.el5_6.1
oval oval:com.redhat.rhsa:tst:20110196007
comment php53-common is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196008
AND
comment php53-dba is earlier than 0:5.3.3-1.el5_6.1
oval oval:com.redhat.rhsa:tst:20110196009
comment php53-dba is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196010
AND
comment php53-devel is earlier than 0:5.3.3-1.el5_6.1
oval oval:com.redhat.rhsa:tst:20110196011
comment php53-devel is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196012
AND
comment php53-gd is earlier than 0:5.3.3-1.el5_6.1
oval oval:com.redhat.rhsa:tst:20110196013
comment php53-gd is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196014
AND
comment php53-imap is earlier than 0:5.3.3-1.el5_6.1
oval oval:com.redhat.rhsa:tst:20110196015
comment php53-imap is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196016
AND
comment php53-intl is earlier than 0:5.3.3-1.el5_6.1
oval oval:com.redhat.rhsa:tst:20110196017
comment php53-intl is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196018
AND
comment php53-ldap is earlier than 0:5.3.3-1.el5_6.1
oval oval:com.redhat.rhsa:tst:20110196019
comment php53-ldap is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196020

AND

comment php53-mbstring is earlier than 0:5.3.3-1.el5_6.1
oval oval:com.redhat.rhsa:tst:20110196021
comment php53-mbstring is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196022

AND
comment php53-mysql is earlier than 0:5.3.3-1.el5_6.1
oval oval:com.redhat.rhsa:tst:20110196023
comment php53-mysql is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196024
AND
comment php53-odbc is earlier than 0:5.3.3-1.el5_6.1
oval oval:com.redhat.rhsa:tst:20110196025
comment php53-odbc is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196026
AND
comment php53-pdo is earlier than 0:5.3.3-1.el5_6.1
oval oval:com.redhat.rhsa:tst:20110196027
comment php53-pdo is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196028
AND
comment php53-pgsql is earlier than 0:5.3.3-1.el5_6.1
oval oval:com.redhat.rhsa:tst:20110196029
comment php53-pgsql is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196030

AND

comment php53-process is earlier than 0:5.3.3-1.el5_6.1
oval oval:com.redhat.rhsa:tst:20110196031
comment php53-process is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196032

AND
comment php53-pspell is earlier than 0:5.3.3-1.el5_6.1
oval oval:com.redhat.rhsa:tst:20110196033
comment php53-pspell is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196034
AND
comment php53-snmp is earlier than 0:5.3.3-1.el5_6.1
oval oval:com.redhat.rhsa:tst:20110196035
comment php53-snmp is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196036
AND
comment php53-soap is earlier than 0:5.3.3-1.el5_6.1
oval oval:com.redhat.rhsa:tst:20110196037
comment php53-soap is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196038
AND
comment php53-xml is earlier than 0:5.3.3-1.el5_6.1
oval oval:com.redhat.rhsa:tst:20110196039
comment php53-xml is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196040
AND
comment php53-xmlrpc is earlier than 0:5.3.3-1.el5_6.1
oval oval:com.redhat.rhsa:tst:20110196041
comment php53-xmlrpc is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196042

rhsa

id	RHSA-2011:0196
released	2011-02-03
severity	Moderate
title	RHSA-2011:0196: php53 security update (Moderate)

rpms

php-0:5.3.2-6.el6_0.1
php-bcmath-0:5.3.2-6.el6_0.1
php-cli-0:5.3.2-6.el6_0.1
php-common-0:5.3.2-6.el6_0.1
php-dba-0:5.3.2-6.el6_0.1
php-debuginfo-0:5.3.2-6.el6_0.1
php-devel-0:5.3.2-6.el6_0.1
php-embedded-0:5.3.2-6.el6_0.1
php-enchant-0:5.3.2-6.el6_0.1
php-gd-0:5.3.2-6.el6_0.1
php-imap-0:5.3.2-6.el6_0.1
php-intl-0:5.3.2-6.el6_0.1
php-ldap-0:5.3.2-6.el6_0.1
php-mbstring-0:5.3.2-6.el6_0.1
php-mysql-0:5.3.2-6.el6_0.1
php-odbc-0:5.3.2-6.el6_0.1
php-pdo-0:5.3.2-6.el6_0.1
php-pgsql-0:5.3.2-6.el6_0.1
php-process-0:5.3.2-6.el6_0.1
php-pspell-0:5.3.2-6.el6_0.1
php-recode-0:5.3.2-6.el6_0.1
php-snmp-0:5.3.2-6.el6_0.1
php-soap-0:5.3.2-6.el6_0.1
php-tidy-0:5.3.2-6.el6_0.1
php-xml-0:5.3.2-6.el6_0.1
php-xmlrpc-0:5.3.2-6.el6_0.1
php-zts-0:5.3.2-6.el6_0.1
php53-0:5.3.3-1.el5_6.1
php53-bcmath-0:5.3.3-1.el5_6.1
php53-cli-0:5.3.3-1.el5_6.1
php53-common-0:5.3.3-1.el5_6.1
php53-dba-0:5.3.3-1.el5_6.1
php53-debuginfo-0:5.3.3-1.el5_6.1
php53-devel-0:5.3.3-1.el5_6.1
php53-gd-0:5.3.3-1.el5_6.1
php53-imap-0:5.3.3-1.el5_6.1
php53-intl-0:5.3.3-1.el5_6.1
php53-ldap-0:5.3.3-1.el5_6.1
php53-mbstring-0:5.3.3-1.el5_6.1
php53-mysql-0:5.3.3-1.el5_6.1
php53-odbc-0:5.3.3-1.el5_6.1
php53-pdo-0:5.3.3-1.el5_6.1
php53-pgsql-0:5.3.3-1.el5_6.1
php53-process-0:5.3.3-1.el5_6.1
php53-pspell-0:5.3.3-1.el5_6.1
php53-snmp-0:5.3.3-1.el5_6.1
php53-soap-0:5.3.3-1.el5_6.1
php53-xml-0:5.3.3-1.el5_6.1
php53-xmlrpc-0:5.3.3-1.el5_6.1

refmap via4

apple	APPLE-SA-2011-10-12-3
bid	45668
confirm	http://bugs.php.net/53632 http://support.apple.com/kb/HT5002
fedora	FEDORA-2011-0321 FEDORA-2011-0329
hp	HPSBMU02752 HPSBOV02763 SSRT100802 SSRT100826
misc	http://hal.archives-ouvertes.fr/docs/00/28/14/29/PDF/floating-point-article.pdf http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/Zend/zend_strtod.c?r1=266327&r2=307095&pathrev=307095 http://www.exploringbinary.com/php-hangs-on-numeric-value-2-2250738585072011e-308/
mlist	[oss-security] 20110105 Re: possible flaw in widely used strtod.c implementation [oss-security] 20110105 possible flaw in widely used strtod.c implementation [oss-security] 20110106 Re: possible flaw in widely used strtod.c implementation
secunia	42812 42843 43051 43189
slackware	SSA:2011-010-01
ubuntu	USN-1042-1
vupen	ADV-2011-0060 ADV-2011-0066 ADV-2011-0077 ADV-2011-0198
xf	php-zendstrtod-dos(64470)

Last major update

15-05-2023 - 00:15

Published

11-01-2011 - 03:00

Last modified

15-05-2023 - 00:15