{
  "threat_severity" : "Low",
  "public_date" : "2010-11-19T00:00:00Z",
  "bugzilla" : {
    "description" : "php: getSymbol() integer overflow vulnerability",
    "id" : "660382",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=660382"
  },
  "cvss" : {
    "cvss_base_score" : "2.6",
    "cvss_scoring_vector" : "AV:N/AC:H/Au:N/C:N/I:N/A:P",
    "status" : "draft"
  },
  "cwe" : "CWE-190",
  "details" : [ "Integer overflow in the NumberFormatter::getSymbol (aka numfmt_get_symbol) function in PHP 5.3.3 and earlier allows context-dependent attackers to cause a denial of service (application crash) via an invalid argument." ],
  "statement" : "This issue did not affect the versions of PHP as shipped with Red Hat Enterprise Linux 4 and 5.  The getSymbol() and setSymbol() functions are unlikely to ever receive untrusted input as an $attr argument, and it is even less likely that they would receive such input when only a small set of pre-defined constants is expected.  As a result, this flaw can only be triggered by the script author and cannot be used to cross trust boundaries.  The Red Hat Security Response Team does not consider it to be security-relevant.",
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 5",
    "fix_state" : "Not affected",
    "package_name" : "php53",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "php",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2010-4409\nhttps://nvd.nist.gov/vuln/detail/CVE-2010-4409" ],
  "name" : "CVE-2010-4409",
  "csaw" : false
}