CVE-2010-4699

Publication date 18 January 2011

Last updated 24 July 2024

Ubuntu priority

Description

The iconv_mime_decode_headers function in the Iconv extension in PHP before 5.3.4 does not properly handle encodings that are unrecognized by the iconv and mbstring (aka Multibyte String) implementations, which allows remote attackers to trigger an incomplete output array, and possibly bypass spam detection or have unspecified other impact, via a crafted Subject header in an e-mail message, as demonstrated by the ks_c_5601-1987 character set.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
php5	10.10 maverick	Ignored
	10.04 LTS lucid	Ignored
	9.10 karmic	Ignored
	8.04 LTS hardy	Ignored
	6.06 LTS dapper	Ignored

Notes

mdeslaur

Upstream doesn't think this has a security impact. Also, see Red Hat bug. Marking as ignored.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
php5	Upstream: http://svn.php.net/viewvc/?view=revision&revision=303890