CVE-2006-0996

The record

Cross-site scripting (XSS) vulnerability in phpinfo (info.c) in PHP 5.1.2 and 4.4.2 allows remote attackers to inject arbitrary web script or HTML via long array variables, including (1) a large number of dimensions or (2) long values, which prevents HTML tags from being removed.

Affected packages

Related vulnerabilities

• CVE-2009-4017 PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files… Also affects php
• CVE-2009-3546 The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD… Also affects php
• CVE-2007-1825 Buffer overflow in the imap_mail_compose function in PHP 5 before 5.2.1, and PHP 4 before… Also affects php
• CVE-2007-1286 Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to… Also affects php
• CVE-2007-1285 The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to… Also affects php
• CVE-2007-0908 The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5… Also affects php
• CVE-2007-0455 Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33… Also affects php
• CVE-2006-1990 Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow… Also affects php