CVE-2010-4645

Publication date 11 January 2011

Last updated 24 July 2024

Ubuntu priority

strtod.c, as used in the zend_strtod function in PHP 5.2 before 5.2.17 and 5.3 before 5.3.5, and other products, allows context-dependent attackers to cause a denial of service (infinite loop) via a certain floating-point value in scientific notation, which is not properly handled in x87 FPU registers, as demonstrated using 2.2250738585072011e-308.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
php5	10.10 maverick	Fixed 5.3.3-1ubuntu9.2
	10.04 LTS lucid	Fixed 5.3.2-1ubuntu4.6
	9.10 karmic	Fixed 5.2.10.dfsg.1-2ubuntu6.6
	8.04 LTS hardy	Fixed 5.2.4-2ubuntu5.13
	6.06 LTS dapper	Fixed 5.1.2-1ubuntu3.20

Notes

sbeattie

unabele to reproduce on 9.10 and before; however, the code in question looks like it ought to be vulnerable. Looking at the compiler flag differences between lucid and karmic's builds didn't show any obvious reason why karmic wouldn't be affected. Released an update for all releases anyway.

CVE-2010-4645

Status

Notes

sbeattie

References

Related Ubuntu Security Notices (USN)

Other references