KLA10931 Denial of service vulnerability in PHP

An unspecified vulnerability was found in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14. By exploiting this vulnerability malicious users can cause a denial of service. Other unspecified impacts are also possible. This vulnerability can be exploited remotely via a locale_get_display_name call with a long first argument.

Technical details

This vulnerability occurs in the get_icu_disp_value_src_php function in ext/intl/locale/locale_methods.c.

Original advisories

PHP Bugs

Related products

PHP

CVE list

CVE-2014-9912 critical

Solution

Update to the latest version

Download PHP

Impacts

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• PHP before 5.3.29PHP 5.4.x before 5.4.30PHP 5.5.x before 5.5.14