CVE-2009-5016
Published Nov 12, 2010 · Updated Nov 3, 2026
Original summary
Normalized public record · Updated Nov 3, 2026
Integer overflow in the xml_utf8_decode function in ext/xml/xml.c in PHP before 5.2.11 makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string that uses overlong UTF-8 encoding, a different vulnerability than CVE-2010-3870.
Publisher and source text is retained separately from QFinch interpretation.
QFinch assessment
Integer overflow in the xml_utf8_decode function in ext/xml/xml.c in PHP before 5.2.11 makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string that uses overlong UTF-8 encoding, a different vulnerability than CVE-2010-3870.
Evidence: public source recordsAffected products
| Affected package, product or range | Fix status |
|---|---|
| Consult the referenced vendor advisory for affected versions. | Consult source advisory |
Matching a version is only one part of assessing exposure. QFinch has not assessed your environment on this public page.
Remediation
Apply the vendor-supported fixed release or mitigation, then verify the affected component is no longer reachable.
- Confirm the affected product and reachable code path exist in your environment.
- Apply the vendor-supported patch or mitigation from the primary advisory.
- Rescan the exact deployed revision and retain verification evidence.
Evidence coverage
- SSVC priority
- LOW
- Confidence
- Not available
- Aliases
- None reported
Scores appear only when corresponding evidence exists. Missing data is never interpreted as zero risk.
Sources and record history
- ADV-2011-0077 ↗
- 44889 ↗
- FEDORA-2010-19011 ↗
- 42812 ↗
- RHSA-2011:0195 ↗
- bugs.php.net ↗
- www.blackhat.com ↗
- USN-1042-1 ↗
- RHSA-2010:0919 ↗
- ADV-2011-0021 ↗
- sirdarckcat.blogspot.com ↗
- 42410 ↗
Record history
Published Nov 12, 2010 · Last refreshed Nov 3, 2026