PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the out_charset parameter to the iconv function; or a long string in the charset parameter to the (2) iconv_mime_decode_headers, (3) iconv_mime_decode, or (4) iconv_strlen function. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade glibc | Jul 30, 2024 | Sep 12, 2007 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 30, 2017 | Sep 12, 2007 |
| Php | — | Upgrade to PHP version 5.2.5 | Oct 1, 2012 | Sep 12, 2007 |
| Php Fixed Iconv Functions To Limit Argument Sizes | — | Upgrade to PHP version 5.2.5 | Sep 16, 2010 | Sep 12, 2007 |
| Suse | — | Upgrade php53-iconvUpgrade php8-readlineUpgrade php53-zipUpgrade php53-posixUpgrade php53-xmlrpcUpgrade php5-iconvUpgrade php5-dbaUpgrade php53-zlibUpgrade php53Upgrade php5-ftpUpgrade php53-ctypeUpgrade php5-pgsqlUpgrade php8-gdUpgrade php8-ctypeUpgrade php8-opcacheUpgrade php5-domUpgrade php5-shmopUpgrade php5-snmpUpgrade php53-opensslUpgrade php8-sysvshmUpgrade php5-ctypeUpgrade php53-fileinfoUpgrade php53-exifUpgrade php8-gmpUpgrade php53-intlUpgrade php53-curlUpgrade php5-exifUpgrade php53-sysvmsgUpgrade php8-sodiumUpgrade php8-calendarUpgrade php5-xmlwriterUpgrade php8-ldapUpgrade php5-curlUpgrade php8-sysvsemUpgrade php8-domUpgrade php53-tokenizerUpgrade php5-xslUpgrade apache2-mod_php53Upgrade php5-mbstringUpgrade php8-sqliteUpgrade php53-imapUpgrade php8-enchantUpgrade php8-pgsqlUpgrade php53-gettextUpgrade php53-sysvsemUpgrade php53-soapUpgrade php53-xmlwriterUpgrade php5-dbaseUpgrade php5-zipUpgrade php8-fpmUpgrade apache2-mod_php8Upgrade php8-fpm-apacheUpgrade php53-xmlreaderUpgrade php5-pearUpgrade php53-xslUpgrade php8-ffiUpgrade php5-sysvmsgUpgrade php8-intlUpgrade php5-tokenizerUpgrade php8-bz2Upgrade php8-bcmathUpgrade php8-curlUpgrade php53-gdUpgrade php8-gettextUpgrade php53-pspellUpgrade php8-xmlwriterUpgrade php8-pdoUpgrade php8Upgrade php5-zlibUpgrade php8-shmopUpgrade php53-domUpgrade php5-xmlrpcUpgrade php8-pharUpgrade php53-pcntlUpgrade php53-develUpgrade php8-xslUpgrade php8-cliUpgrade php8-iconvUpgrade php53-mcryptUpgrade php53-mysqlUpgrade php8-dbaUpgrade php8-opensslUpgrade php53-snmpUpgrade php53-mbstringUpgrade php8-zipUpgrade php53-ldapUpgrade php53-readlineUpgrade php53-wddxUpgrade php5-mcryptUpgrade php8-fastcgiUpgrade php53-suhosinUpgrade php5-wddxUpgrade php53-dbaUpgrade php53-pdoUpgrade php53-tidyUpgrade php5-bz2Upgrade php5-ldapUpgrade php5-xmlreaderUpgrade php53-pgsqlUpgrade php53-fastcgiUpgrade php8-exifUpgrade php8-mbstringUpgrade php8-ftpUpgrade php5-gmpUpgrade php53-bz2Upgrade php8-tidyUpgrade php53-shmopUpgrade php8-tokenizerUpgrade php5-soapUpgrade php5-mysqlUpgrade php5-opensslUpgrade php5-pdoUpgrade php53-bcmathUpgrade php8-fileinfoUpgrade php5-odbcUpgrade php5-calendarUpgrade php53-sqliteUpgrade php53-ftpUpgrade php5-fastcgiUpgrade php8-mysqlUpgrade php53-sysvshmUpgrade php5Upgrade php5-pspellUpgrade php8-zlibUpgrade php5-bcmathUpgrade php53-socketsUpgrade php53-odbcUpgrade php8-posixUpgrade php53-pearUpgrade php5-sysvshmUpgrade php8-odbcUpgrade php8-embedUpgrade php8-xmlreaderUpgrade php5-jsonUpgrade php8-pcntlUpgrade php5-gdUpgrade php8-sysvmsgUpgrade php53-calendarUpgrade php8-snmpUpgrade php8-soapUpgrade php5-pcntlUpgrade php5-gettextUpgrade php53-gmpUpgrade php8-socketsUpgrade php5-suhosinUpgrade php5-hashUpgrade apache2-mod_php5Upgrade php53-jsonUpgrade php8-develUpgrade php5-sysvsem | Feb 17, 2015 | Jul 9, 2013 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub