PT-2016-3379 · Php+3 · Php+3
Fernando
·
Publicado
2016-09-17
·
Atualizado
2018-05-04
·
CVE-2016-7416
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
PHP versions prior to 5.6.26
PHP versions 7.x prior to 7.0.11
Description
The issue is caused by a buffer overflow in the ext/intl/msgformat/msgformat format.c component of the PHP interpreter. This can be exploited by a remote attacker to cause a denial of service through a call to
MessageFormatter::formatMessage. The problem arises from the improper restriction of the locale length provided to the Locale class in the ICU library, allowing attackers to potentially crash the application or have other unspecified impacts by making a MessageFormatter::formatMessage call with a long first argument.Recommendations
For PHP versions prior to 5.6.26, update to version 5.6.26 or later.
For PHP versions 7.x prior to 7.0.11, update to version 7.0.11 or later.
As a temporary workaround, consider restricting the use of the
MessageFormatter::formatMessage function with long arguments until a patch is available.Exploit
Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Icu Library
Php
Suse
Ubuntu