PHP libicu 'locale_get_display_name()' Stack Buffer Overflow Vulnerability
BID:68549
Info
PHP libicu 'locale_get_display_name()' Stack Buffer Overflow Vulnerability
| Bugtraq ID: | 68549 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2014-9912 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 08 2014 12:00AM |
| Updated: | Mar 07 2017 03:03AM |
| Credit: | mikispag |
| Vulnerable: |
Ubuntu Ubuntu Linux 14.04 LTS Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 PHP PHP 5.5.13 PHP PHP 5.5.12 PHP PHP 5.5.11 PHP PHP 5.5.10 PHP PHP 5.5.6 PHP PHP 5.5.5 PHP PHP 5.5.4 PHP PHP 5.5.3 PHP PHP 5.5.1 PHP PHP 5.5 PHP PHP 5.4.29 PHP PHP 5.4.26 PHP PHP 5.4.25 PHP PHP 5.4.17 PHP PHP 5.4.14 PHP PHP 5.4.8 PHP PHP 5.4.7 PHP PHP 5.4.6 PHP PHP 5.4.4 PHP PHP 5.4.3 PHP PHP 5.4.2 PHP PHP 5.4.1 PHP PHP 5.3.28 PHP PHP 5.3.24 PHP PHP 5.3.23 PHP PHP 5.3.22 PHP PHP 5.3.21 PHP PHP 5.3.20 PHP PHP 5.3.17 PHP PHP 5.3.16 PHP PHP 5.3.14 PHP PHP 5.3.13 PHP PHP 5.3.12 PHP PHP 5.3.9 PHP PHP 5.3.8 PHP PHP 5.3.7 PHP PHP 5.3.6 PHP PHP 5.3.5 PHP PHP 5.3.2 PHP PHP 5.3.1 PHP PHP 5.3 PHP PHP 5.5.9 PHP PHP 5.5.8 PHP PHP 5.5.7 PHP PHP 5.5.2 PHP PHP 5.4.9 PHP PHP 5.4.5 PHP PHP 5.4.28 PHP PHP 5.4.27 PHP PHP 5.4.24 PHP PHP 5.4.23 PHP PHP 5.4.22 PHP PHP 5.4.21 PHP PHP 5.4.20 PHP PHP 5.4.19 PHP PHP 5.4.18 PHP PHP 5.4.16 PHP PHP 5.4.15 PHP PHP 5.4.13 PHP PHP 5.4.12 PHP PHP 5.4.11 PHP PHP 5.4.10 PHP PHP 5.3.4 PHP PHP 5.3.3 PHP PHP 5.3.27 PHP PHP 5.3.26 PHP PHP 5.3.25 PHP PHP 5.3.19 PHP PHP 5.3.18 PHP PHP 5.3.15 PHP PHP 5.3.11 PHP PHP 5.3.10 ICU libicu 4.8.1 |
| Not Vulnerable: |
PHP PHP 5.6 PHP PHP 5.5.14 PHP PHP 5.4.30 PHP PHP 5.3.29 |
Discussion
PHP libicu 'locale_get_display_name()' Stack Buffer Overflow Vulnerability
PHP is prone to a stack-based buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied data before copying it into an insufficiently sized buffer.
Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.
Note: This issue was previously titled 'libicu 'locale_get_display_name()' Buffer Overflow Vulnerability'. The title and technical details have been changed to better reflect the underlying component affected.
PHP is prone to a stack-based buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied data before copying it into an insufficiently sized buffer.
Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.
Note: This issue was previously titled 'libicu 'locale_get_display_name()' Buffer Overflow Vulnerability'. The title and technical details have been changed to better reflect the underlying component affected.
Exploit / POC
PHP libicu 'locale_get_display_name()' Stack Buffer Overflow Vulnerability
The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.
The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.
Solution / Fix
PHP libicu 'locale_get_display_name()' Stack Buffer Overflow Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
PHP libicu 'locale_get_display_name()' Stack Buffer Overflow Vulnerability
References:
References: