PHP '/ext/enchant/enchant.c' Heap Based Buffer Overflow Vulnerability

Bugtraq ID:	73031
Class:	Boundary Condition Error
CVE:	CVE-2014-9705
Remote:	Yes
Local:	No
Published:	Feb 20 2015 12:00AM
Updated:	Jul 05 2016 09:28PM
Credit:	PHP
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Red Hat Enterprise Linux Workstation Optional 6 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server Optional 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop Optional 6 PHP PHP 5.4.3 PHP PHP 5.4.2 PHP PHP 5.4.1 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 HP Virtual Connect Enterprise Manager 6.2 HP Virtual Connect Enterprise Manager 6.1 HP Virtual Connect Enterprise Manager 6.0 HP Version Control Agent 2.1.5 HP Systems Insight Manager 7.0 HP Systems Insight Manager 6.3 HP Systems Insight Manager 6.2 HP Systems Insight Manager 6.1 HP Systems Insight Manager 6.0 HP Systems Insight Manager 5.3 HP Systems Insight Manager 5.0 HP Systems Insight Manager 4.2 HP System Management Homepage 6.2.2 7 HP System Management Homepage 3.0.2 .77 HP System Management Homepage 3.0 .68 HP System Management Homepage 3.0 .64 HP System Management Homepage 2.2.9 .1 HP System Management Homepage 2.2.8 HP System Management Homepage 2.2.6 HP System Management Homepage 2.1.12 HP System Management Homepage 2.1.11 HP System Management Homepage 2.1.10 HP System Management Homepage 2.1.9 HP System Management Homepage 2.1.8 HP System Management Homepage 2.1.7 HP System Management Homepage 2.1.6 HP System Management Homepage 2.1.5 HP System Management Homepage 2.1.4 HP System Management Homepage 2.1.3 HP System Management Homepage 2.1.2 HP System Management Homepage 2.1.1 HP System Management Homepage 2.1 HP System Management Homepage 2.0.2 HP System Management Homepage 2.0.1 HP System Management Homepage 2.0 HP System Management Homepage 7.0 HP System Management Homepage 6.3 HP System Management Homepage 6.2 HP System Management Homepage 6.0 HP Insight Orchestration 6.2 HP Insight Orchestration 6.1 HP Insight Orchestration 6.0 CentOS CentOS 6 Apple Mac Os X 10.7.4 Apple Mac Os X 10.7.3 Apple Mac Os X 10.7.1
Not Vulnerable:

PHP '/ext/enchant/enchant.c' Heap Based Buffer Overflow Vulnerability

PHP is prone to a remote heap-based buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will result in denial-of-service conditions.

This issue is fixed in PHP 5.6.6, 5.5.22 and 5.4.38.

PHP '/ext/enchant/enchant.c' Heap Based Buffer Overflow Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

PHP '/ext/enchant/enchant.c' Heap Based Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

PHP '/ext/enchant/enchant.c' Heap Based Buffer Overflow Vulnerability

References:

• PHP Homepage (PHP)