NetSight
IP …
medium5.0Public exploit code

CVE-2010-4645

strtod.c, as used in the zend_strtod function in PHP 5.2 before 5.2.17 and 5.3 before 5.3.5, and other products, allows context-dependent attackers to cause a …

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

strtod.c, as used in the zend_strtod function in PHP 5.2 before 5.2.17 and 5.3 before 5.3.5, and other products, allows context-dependent attackers to cause a denial of service (infinite loop) via a certain floating-point value in scientific notation, which is not properly handled in x87 FPU registers, as demonstrated using 2.2250738585072011e-308.

Affected products

VendorProductAffected versions
PhpPhp
Versions 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5

Weakness classification

CWE-189

References