CVE-2014-9912

php: stack buffer overflow in locale_get_display_name

Published Jan 4, 2017 CVSS 3.0 · 9.8 Critical EPSS 4.9% KEV · Not listed
Description
The get_icu_disp_value_src_php function in ext/intl/locale/locale_methods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a locale_get_display_name call with a long first argument.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2014-9717 The get_icu_disp_value_src_php function in ext/intl/locale/locale_methods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a locale_get_display_name call with a long first argument.
Ubuntu USN Ubuntu USN USN-3196-1 PHP vulnerabilities
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 6, 2024, 2:02 PM
Reserved
Nov 24, 2016, 12:00 AM
Status
Modified
Published
Jan 4, 2017, 8:59 PM
Modified
Jun 17, 2026, 12:19 AM
Severity
Moderate
Public date
Jun 8, 2014, 12:00 AM