CVE-2010-1128

The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function.

• CWE-310

• http://secunia.com/advisories/38708Vendor Advisory
• http://secunia.com/advisories/42410
• http://www.php.net/ChangeLog-5.php
• http://www.php.net/releases/5_2_13.phpVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2010-0919.html
• http://www.securityfocus.com/bid/38430Exploit
• http://www.vupen.com/english/advisories/2010/0479Patch, Vendor Advisory
• http://www.vupen.com/english/advisories/2010/3081
• http://secunia.com/advisories/38708Vendor Advisory
• http://secunia.com/advisories/42410
• http://www.php.net/ChangeLog-5.php
• http://www.php.net/releases/5_2_13.phpVendor Advisory
• http://www.redhat.com/support/errata/RHSA-2010-0919.html
• http://www.securityfocus.com/bid/38430Exploit
• http://www.vupen.com/english/advisories/2010/0479Patch, Vendor Advisory
• http://www.vupen.com/english/advisories/2010/3081

Published

Mar 26, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-1122Unspecified vulnerability in Mozilla Firefox 3.5.x through 3…
• CVE-2010-1123Chip Salzenberg Deliver does not properly associate a lockfi…
• CVE-2010-1124bos.rte.libc 5.3.9.4 on IBM AIX 5.3 does not properly suppor…
• CVE-2010-1125The JavaScript implementation in Mozilla Firefox 3.x before …
• CVE-2010-1126The JavaScript implementation in WebKit allows remote attack…
• CVE-2010-1127Microsoft Internet Explorer 6 and 7 does not initialize cert…
• CVE-2010-1129The safe_mode implementation in PHP before 5.2.13 does not p…
• CVE-2010-1130session.c in the session extension in PHP before 5.2.13, and…
• CVE-2010-1131JavaScriptCore.dll, as used in Apple Safari 4.0.5 on Windows…
• CVE-2010-1132The mlfi_envrcpt function in spamass-milter.cpp in SpamAssas…
• CVE-2010-1133Multiple SQL injection vulnerabilities in TikiWiki CMS/Group…
• CVE-2010-1134SQL injection vulnerability in the _find function in searchl…