PT-2017-2504 · Unicode Consortium+3 · International Components For Unicode (Icu) For C/C+++3
Published
2017-07-08
·
Updated
2019-05-22
·
CVE-2017-11362
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
PHP versions 7.0.0 through 7.0.20
PHP versions 7.1.0 through 7.1.6
Description
The issue is caused by a stack-based buffer overflow in the msgfmt parse message function within International Components for Unicode (ICU) for C/C++. This allows remote attackers to cause a denial of service (application crash) or possibly have other unspecified impacts by providing a long first argument to the function. The
msgfmt parse message function is vulnerable due to the lack of restriction on the locale length.Recommendations
For PHP versions 7.0.0 through 7.0.20, update to version 7.0.21 or later.
For PHP versions 7.1.0 through 7.1.6, update to version 7.1.7 or later.
Fix
DoS
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
International Components For Unicode (Icu) For C/C++
Php
Ubuntu