The calendar module in phpWebSite 0.9.x and earlier allows remote attackers to cause a denial of service (crash) via a long year parameter.
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
Link | Tags |
---|---|
http://marc.info/?l=bugtraq&m=106252188522715&w=2 | mailing list |
http://marc.info/?l=bugtraq&m=106062021711496&w=2 | mailing list |