CVE-2016-6294
CRITICAL
9.8
CVSS 3.0
Description
The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument.
Affected products and versions
- PHP — Up to and including 5.5.37
- PHP versions 5.6.0alpha1, 5.6.0alpha2, 5.6.0alpha3, 5.6.0alpha4, 5.6.0alpha5, 5.6.0beta1, 5.6.0beta2, 5.6.0beta3, 5.6.0beta4, 5.6.1, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.6.10, 5.6.11, 5.6.12, 5.6.13, 5.6.14, 5.6.15, 5.6.16, 5.6.17, 5.6.18, 5.6.19, 5.6.20, 5.6.21, 5.6.22, 5.6.23, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.8
References
- git.php.net http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=aa82e99ed8003c01f1ef4f0940e56b85c5b032d4
- lists.apple.com http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
- openwall.com http://openwall.com/lists/oss-security/2016/07/24/2 Mailing List
- php.net http://php.net/ChangeLog-5.php Release Notes
- php.net http://php.net/ChangeLog-7.php Release Notes
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2016-2750.html
- www.debian.org http://www.debian.org/security/2016/dsa-3631
- www.securityfocus.com http://www.securityfocus.com/bid/92115 Third Party Advisory, VDB Entry
- www.securitytracker.com http://www.securitytracker.com/id/1036430
- bugs.php.net https://bugs.php.net/72533 Exploit, Issue Tracking, Mitigation, Patch, Third Party Advisory
- security.gentoo.org https://security.gentoo.org/glsa/201611-22
- support.apple.com https://support.apple.com/HT207170
- nvd.nist.gov Official NVD record