[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 7 Dec 2010 12:01:47 +0100
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request (PHP 5.3.x getSymbol() DoS; CERT
VU#479900)
On Mon, 6 Dec 2010 10:15:28 -0700 Vincent Danen wrote:
> CERT has a bulletin up regarding a DoS in the getSymbol() function
> (integer overflow vulnerability):
>
> http://www.kb.cert.org/vuls/id/479900
> http://svn.php.net/viewvc?view=revision&revision=305571
> http://php.net/manual/en/numberformatter.getsymbol.php
Btw, setSymbol() is affected too, and does not seem to be addressed in
r305571. In both cases, it's PHP exposing ICU bug.
--
Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
