The get_icu_disp_value_src_php function in ext/intl/locale/locale_methods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a locale_get_display_name call with a long first argument.
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/68549 | vdb entry |
| https://bugzilla.redhat.com/show_bug.cgi?id=1383569 | issue tracking patch vdb entry third party advisory |
| http://www.openwall.com/lists/oss-security/2016/11/25/1 | third party advisory mailing list |
| http://www.php.net/ChangeLog-5.php | release notes vendor advisory |
| https://bugs.php.net/bug.php?id=67397 | patch vendor advisory |