Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

PHP mbstring extension can run malicious code

CVE-2008-5557 · published 17 years ago
Summary

PHP versions 4.3.0 through 5.2.6 have a flaw in the mbstring component that mishandles certain HTML entity strings during character conversion. An attacker who can supply such a string could cause the server to execute unwanted code. Upgrade PHP to a newer version or disable the mbstring extension until the issue is patched.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
php php 5.2.3
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.3.10
30 more version ranges
cpe:2.3:a:php:php:5.2.3:*:*:*:*:*:*:*
Original advisory text
Heap-based buffer overflow in ext/mbstring/libmbfl/filters/mbfilter_htmlent.c in the mbstring extension in PHP 4.3.0 through 5.2.6 allows context-dependent attackers to execute arbitrary code via a...
Heap-based buffer overflow in ext/mbstring/libmbfl/filters/mbfilter_htmlent.c in the mbstring extension in PHP 4.3.0 through 5.2.6 allows context-dependent attackers to execute arbitrary code via a crafted string containing an HTML entity, which is not properly handled during Unicode conversion, related to the (1) mb_convert_encoding, (2) mb_check_encoding, (3) mb_convert_variables, and (4) mb_parse_str functions.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
7% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published23 Dec 2008
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2008-5557 · NVD
Track software like this
Free during beta