Public Date:
478848: CVE-2008-5557 php: Heap-based buffer overflow in the mbstring extension via crafted string containing a HTML entity (arb code execution)

The MITRE CVE dictionary describes this issue as:

Heap-based buffer overflow in ext/mbstring/libmbfl/filters/mbfilter_htmlent.c in the mbstring extension in PHP 4.3.0 through 5.2.6 allows context-dependent attackers to execute arbitrary code via a crafted string containing an HTML entity, which is not properly handled during Unicode conversion, related to the (1) mb_convert_encoding, (2) mb_check_encoding, (3) mb_convert_variables, and (4) mb_parse_str functions.

Find out more about CVE-2008-5557 from the MITRE CVE dictionary dictionary and NIST NVD.

Red Hat Security Errata

Platform Errata Release Date
Red Hat Application Stack v2 for Enterprise Linux (v.5) (php) RHSA-2009:0350 2009-04-14
Red Hat Enterprise Linux version 4 (php) RHSA-2009:0337 2009-04-06
Red Hat Enterprise Linux version 3 (php) RHSA-2009:0337 2009-04-06
Red Hat Enterprise Linux version 5 (php) RHSA-2009:0338 2009-04-06