CVE-2016-6294
published 2016-07-25CVE-2016-6294: The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly…
PriorityP341critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
5.96%
92.5th percentile
The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument.
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos_sierra | — | — |
| php | php | <= 5.5.37 | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
| php | php | — | — |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-m629-55p3-x5vv: The locale_accept_from_http function in ext/intl/locale/locale_methods
ghsa_unreviewed·2022-05-14
CVE-2016-6294 [CRITICAL] CWE-125 GHSA-m629-55p3-x5vv: The locale_accept_from_http function in ext/intl/locale/locale_methods
The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument.
OSV
php5, php7.0 vulnerabilities
osv·2016-08-02·CVSS 9.8
CVE-2015-4116 [CRITICAL] php5, php7.0 vulnerabilities
php5, php7.0 vulnerabilities
It was discovered that PHP incorrectly handled certain SplMinHeap::compare
operations. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly execute arbitrary code. This
issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-4116)
It was discovered that PHP incorrectly handled recursive method calls. A
remote attacker could use this issue to cause PHP to crash, resulting in a
denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu
14.04 LTS. (CVE-2015-8873)
It was discovered that PHP incorrectly validated certain Exception objects
when unserializing data. A remote attacker could use this issue to cause
PHP to crash, resulting in a denial of service, or possibly execute
arbitr
OSV
CVE-2016-6294: The locale_accept_from_http function in ext/intl/locale/locale_methods
osv·2016-07-25·CVSS 9.8
CVE-2016-6294 [CRITICAL] CVE-2016-6294: The locale_accept_from_http function in ext/intl/locale/locale_methods
The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument.
Apple
CVE-2016-6294: macOS Sierra 10.12
vendor_apple·2016-09-20·CVSS 9.8
CVE-2016-6294 [CRITICAL] CVE-2016-6294: macOS Sierra 10.12
Apple Security Update: About the security content of macOS Sierra 10.12
Product: macOS Sierra
Version: 10.12
CVE: CVE-2016-6294
Component: CVE-2016-6294
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2016-08-02·CVSS 9.8
CVE-2015-4116 [CRITICAL] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: Several security issues were fixed in PHP.
It was discovered that PHP incorrectly handled certain SplMinHeap::compare
operations. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly execute arbitrary code. This
issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-4116)
It was discovered that PHP incorrectly handled recursive method calls. A
remote attacker could use this issue to cause PHP to crash, resulting in a
denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu
14.04 LTS. (CVE-2015-8873)
It was discovered that PHP incorrectly validated certain Exception objects
when unserializing data. A remote attacker could use this issue to cause
PHP to crash, resulting
Red Hat
php: Out-of-bounds access in locale_accept_from_http
vendor_redhat·2016-07-03·CVSS 9.8
CVE-2016-6294 [CRITICAL] CWE-125 php: Out-of-bounds access in locale_accept_from_http
php: Out-of-bounds access in locale_accept_from_http
The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument.
Package: php (Red Hat Enterprise Linux 5) - Not affected
Package: php53 (Red Hat Enterprise Linux 5) - Will not fix
Package: php (Red Hat Enterprise Linux 6) - Will not fix
Package: php (Red Hat Enterprise Linux 7) - Will not fix
Package: php54-php (Red Hat Software Collections) - Will not fix
Package: php55-php (Red Hat Software Collections) - Will not fix
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-9911 icu: stack-based buffer overflow in uloc_getDisplayName
bugzilla·2016-10-11·CVSS 9.8
CVE-2014-9911 [CRITICAL] CVE-2014-9911 icu: stack-based buffer overflow in uloc_getDisplayName
CVE-2014-9911 icu: stack-based buffer overflow in uloc_getDisplayName
A locale string of more than 255 characters passed to uloc_getDisplayName() could overflow a buffer on the stack, leading a crash or, potentially, code execution.
Upstream patch:
http://bugs.icu-project.org/trac/changeset/35699
Upstream issue (private as at 2016-10-11):
http://bugs.icu-project.org/trac/ticket/10891
Discussion:
PHP bug (already fixed in bug 1065838):
https://bugs.php.net/bug.php?id=67397
Related ICU bug:
http://bugs.icu-project.org/trac/ticket/11936
---
Created mingw-icu tracking bugs for this issue:
Affects: fedora-all [bug 1397625]
Affects: epel-7 [bug 1397626]
---
The affected function has only one buffer on the stack, and it is overflowed at the end by copying a null-terminated string w
Bugzilla
CVE-2016-6294 php: Out-of-bounds access in locale_accept_from_http
bugzilla·2016-07-25·CVSS 9.8
CVE-2016-6294 [CRITICAL] CVE-2016-6294 php: Out-of-bounds access in locale_accept_from_http
CVE-2016-6294 php: Out-of-bounds access in locale_accept_from_http
Calling to uloc_acceptLanguageFromHTTP with parameter size "httpAcceptLanguage" equal or greater than ULOC_FULLNAME_CAPACITY + 1, the local variable "tmp" might leave unterminated. uloc_acceptLanguageFromHTTP doesn’t check status result after call to uloc_canonicalize. This might cause stack data leak.
PHP bug:
https://bugs.php.net/bug.php?id=72533
PHP fix:
http://git.php.net/?p=php-src.git;a=commit;h=aa82e99ed8003c01f1ef4f0940e56b85c5b032d4
CVE assignment:
http://seclists.org/oss-sec/2016/q3/137
Discussion:
Created php tracking bugs for this issue:
Affects: fedora-all [bug 1359837]
---
This issue has been addressed in the following products:
Red Hat Software Collections for Red Hat Enterprise Linux 6
Red Hat S
Bugzilla
CVE-2016-6289 CVE-2016-6290 CVE-2016-6291 CVE-2016-6292 CVE-2016-6294 CVE-2016-6295 CVE-2016-6296 CVE-2016-6297 php: various flaws [fedora-all]
bugzilla·2016-07-25·CVSS 7.8
CVE-2016-6289 [HIGH] CVE-2016-6289 CVE-2016-6290 CVE-2016-6291 CVE-2016-6292 CVE-2016-6294 CVE-2016-6295 CVE-2016-6296 CVE-2016-6297 php: various flaws [fedora-all]
CVE-2016-6289 CVE-2016-6290 CVE-2016-6291 CVE-2016-6292 CVE-2016-6294 CVE-2016-6295 CVE-2016-6296 CVE-2016-6297 php: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=aa82e99ed8003c01f1ef4f0940e56b85c5b032d4http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.htmlhttp://openwall.com/lists/oss-security/2016/07/24/2http://php.net/ChangeLog-5.phphttp://php.net/ChangeLog-7.phphttp://rhn.redhat.com/errata/RHSA-2016-2750.htmlhttp://www.debian.org/security/2016/dsa-3631http://www.securityfocus.com/bid/92115http://www.securitytracker.com/id/1036430https://bugs.php.net/72533https://security.gentoo.org/glsa/201611-22https://support.apple.com/HT207170http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=aa82e99ed8003c01f1ef4f0940e56b85c5b032d4http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.htmlhttp://openwall.com/lists/oss-security/2016/07/24/2http://php.net/ChangeLog-5.phphttp://php.net/ChangeLog-7.phphttp://rhn.redhat.com/errata/RHSA-2016-2750.htmlhttp://www.debian.org/security/2016/dsa-3631http://www.securityfocus.com/bid/92115http://www.securitytracker.com/id/1036430https://bugs.php.net/72533https://security.gentoo.org/glsa/201611-22https://support.apple.com/HT207170
2016-07-25
Published