CVE-2017-11362 | BDVDB-2026-87809 Detail

Description#

In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7, ext/intl/msgformat/msgformat_parse.c does not restrict the locale length, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact within International Components for Unicode (ICU) for C/C++ via a long first argument to the msgfmt_parse_message function.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12017-07-17Record published in the CVE List.
2. Version 22024-08-05Most recent update recorded in the CVE List.