CVE-2010-4657: Debian Linux

High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days.

PHP5 before 5.4.4 allows passing invalid utf-8 strings via the xmlTextWriterWriteAttribute, which are then misparsed by libxml2. This results in memory leak into the resulting output.

Affected products

• Debian Debian Linux: version 8.0 only
• PHP PHP: from 5.0.0, before 5.4.4 (fixed in 5.4.4)
• Red Hat Enterprise Linux: version 5.0 only; version 6.0 only

Published 2019-11-13. Last modified 2026-06-16.