VULNERABILITY INTELLIGENCE

CVE-2010-4657

CVSS score7.5 HIGH
EPSS probability1.54%
CISA KEVNot currently listed
Published2019-11-13
Last modified2026-06-16
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

PHP5 before 5.4.4 allows passing invalid utf-8 strings via the xmlTextWriterWriteAttribute, which are then misparsed by libxml2. This results in memory leak into the resulting output.

Weakness classification

  • CWE-772: Missing Release of Resource after Effective Lifetime

Primary references