CVE-2006-5465

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-11-04 · updated 2026-06-16

Description

Buffer overflow in PHP before 5.2.0 allows remote attackers to execute arbitrary code via crafted UTF-8 inputs to the (1) htmlentities or (2) htmlspecialchars functions.

Affected products

PHP: through 5.1.6; 5.0-rc1, 5.0-rc2, 5.0-rc3, 5.0.0, 5.0.1, 5.0.2 (+9)

References

http://docs.info.apple.com/article.html?artnum=304829
http://issues.rpath.com/browse/RPL-761
http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html
http://rhn.redhat.com/errata/RHSA-2006-0736.html
http://secunia.com/advisories/22653
http://secunia.com/advisories/22685
http://secunia.com/advisories/22688
http://secunia.com/advisories/22693
http://secunia.com/advisories/22713
http://secunia.com/advisories/22753
http://secunia.com/advisories/22759

Get alerted when CVE-2006-5465 or the next vulnerability affects your stack