FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2004-0595

This CVE name corresponds to:

Entered	Topic
2004-09-27	php -- strip_tags cross-site scripting vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2004-0595 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2004-0595
Phase	Assigned(20040623)

Description

The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\0) characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and facilitate the exploitation of cross-site scripting (XSS) vulnerabilities.

References

Source	Reference
FULLDISC	20040714 Advisory 12/2004: PHP strip_tags() bypass vulnerability
BUGTRAQ	20040713 Advisory 11/2004: PHP memory_limit remote vulnerability
BUGTRAQ	20040714 TSSA-2004-013 - php
CONECTIVA	CLA-2004:847
DEBIAN	DSA-531
DEBIAN	DSA-669
GENTOO	GLSA-200407-13
HP	SSRT4777
MANDRAKE	MDKSA-2004:068
REDHAT	RHSA-2004:392
REDHAT	RHSA-2004:395
REDHAT	RHSA-2004:405
REDHAT	RHSA-2005:816
SUSE	SUSE-SA:2004:021
BUGTRAQ	20040722 [OpenPKG-SA-2004.034] OpenPKG Security Advisory (php)
BID	10724
OVAL	oval:org.mitre.oval:def:10619
XF	php-strip-tag-bypass(16692)