Unrated severityNVD Advisory· Published Nov 12, 2010· Updated Jun 16, 2026
CVE-2010-3870
CVE-2010-3870
Description
The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
7cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*+ 4 more
- cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
33- svn.php.net/viewvcnvdPatchVendor Advisory
- bugs.php.net/bug.phpnvdExploitVendor Advisory
- bugs.php.net/bug.phpnvdExploitVendor Advisory
- sirdarckcat.blogspot.com/2009/10/couple-of-unicode-issues-on-php-and.htmlnvdExploitThird Party Advisory
- us2.php.net/manual/en/function.utf8-decode.phpnvdExploitVendor Advisory
- www.acunetix.com/blog/web-security-articles/security-risks-associated-with-utf8_decode/nvdExploitThird Party Advisory
- www.blackhat.com/presentations/bh-usa-09/VELANAVA/BHUSA09-VelaNava-FavoriteXSS-SLIDES.pdfnvdExploitThird Party Advisory
- lists.apple.com/archives/security-announce/2011/Mar/msg00006.htmlnvdMailing ListThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2011-January/052836.htmlnvdMailing ListThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2011-January/052845.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.htmlnvdMailing ListThird Party Advisory
- marc.infonvdMailing ListThird Party Advisory
- secunia.com/advisories/42410nvdThird Party Advisory
- secunia.com/advisories/42812nvdThird Party Advisory
- support.apple.com/kb/HT4581nvdThird Party Advisory
- www.mandriva.com/en/security/advisoriesnvdThird Party Advisory
- www.openwall.com/lists/oss-security/2010/11/02/1nvdMailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2010/11/02/11nvdMailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2010/11/02/2nvdMailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2010/11/02/4nvdMailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2010/11/02/6nvdMailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2010/11/02/8nvdMailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2010/11/03/1nvdMailing ListThird Party Advisory
- www.php.net/ChangeLog-5.phpnvdVendor Advisory
- www.redhat.com/support/errata/RHSA-2010-0919.htmlnvdThird Party Advisory
- www.redhat.com/support/errata/RHSA-2011-0195.htmlnvdThird Party Advisory
- www.securityfocus.com/bid/44605nvdThird Party AdvisoryVDB Entry
- www.securitytracker.com/idnvdThird Party AdvisoryVDB Entry
- www.ubuntu.com/usn/USN-1042-1nvdThird Party Advisory
- www.vupen.com/english/advisories/2010/3081nvdThird Party Advisory
- www.vupen.com/english/advisories/2011/0020nvdThird Party Advisory
- www.vupen.com/english/advisories/2011/0021nvdThird Party Advisory
- www.vupen.com/english/advisories/2011/0077nvdThird Party Advisory
News mentions
0No linked articles in our index yet.