PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the out_charset parameter to the iconv function; or a long string in the charset parameter to the (2) iconv_mime_decode_headers, (3) iconv_mime_decode, or (4) iconv_strlen function. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade glibc | Jul 30, 2024 | Sep 12, 2007 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 30, 2017 | Sep 12, 2007 |
| Php | — | Upgrade to PHP version 5.2.5 | Oct 1, 2012 | Sep 12, 2007 |
| Php Fixed Iconv Functions To Limit Argument Sizes | — | Upgrade to PHP version 5.2.5 | Sep 16, 2010 | Sep 12, 2007 |
| Suse | — | Upgrade php8-gmpUpgrade php8-readlineUpgrade php53-pspellUpgrade php5-zipUpgrade php5-tokenizerUpgrade php5-pgsqlUpgrade php8-ctypeUpgrade php8-xmlwriterUpgrade php53-tokenizerUpgrade php8-ffiUpgrade php53-xmlwriterUpgrade php5-sysvmsgUpgrade php5-curlUpgrade php53-exifUpgrade php53-imapUpgrade php53-sysvmsgUpgrade php8-pgsqlUpgrade php53-sysvsemUpgrade php53-zlibUpgrade php5-dbaseUpgrade php8-sqliteUpgrade php5-xmlwriterUpgrade php53-posixUpgrade php5-mbstringUpgrade php5-xmlrpcUpgrade php8-bcmathUpgrade php53-xmlreaderUpgrade php5-iconvUpgrade php8-gettextUpgrade php8-enchantUpgrade php53-domUpgrade php8-sysvshmUpgrade php8-shmopUpgrade php5-ctypeUpgrade php53-fileinfoUpgrade php53-opensslUpgrade php5-xslUpgrade php8-bz2Upgrade php8-fpm-apacheUpgrade php8-intlUpgrade php8-domUpgrade php5-pearUpgrade php53-gdUpgrade php8-pharUpgrade php8-curlUpgrade php53-curlUpgrade php5-shmopUpgrade php8-gdUpgrade php53-iconvUpgrade php5-ftpUpgrade apache2-mod_php8Upgrade php8-fpmUpgrade php5-zlibUpgrade php53-develUpgrade php8-ldapUpgrade php53-pcntlUpgrade php53-ctypeUpgrade php53-zipUpgrade php5-dbaUpgrade php5-exifUpgrade php53Upgrade php8-sodiumUpgrade php53-xslUpgrade php53-soapUpgrade php53-xmlrpcUpgrade php53-gettextUpgrade php8-calendarUpgrade php5-snmpUpgrade php8-opcacheUpgrade php8Upgrade php53-intlUpgrade php8-pdoUpgrade apache2-mod_php53Upgrade php8-sysvsemUpgrade php5-domUpgrade php5-gmpUpgrade php8-tidyUpgrade php5-sysvsemUpgrade php5Upgrade php5-bz2Upgrade php53-bcmathUpgrade php5-calendarUpgrade php8-socketsUpgrade php8-iconvUpgrade php5-fastcgiUpgrade php8-cliUpgrade php53-snmpUpgrade php5-mcryptUpgrade php5-odbcUpgrade php8-opensslUpgrade php8-odbcUpgrade php8-zlibUpgrade php53-ftpUpgrade php8-sysvmsgUpgrade php5-gdUpgrade php8-pcntlUpgrade php5-wddxUpgrade php5-xmlreaderUpgrade php8-xslUpgrade php53-shmopUpgrade php5-sysvshmUpgrade php5-soapUpgrade php5-mysqlUpgrade php5-pspellUpgrade php53-calendarUpgrade php53-tidyUpgrade php8-fastcgiUpgrade php8-soapUpgrade php53-fastcgiUpgrade php53-wddxUpgrade php8-dbaUpgrade php53-jsonUpgrade php53-dbaUpgrade php8-embedUpgrade php8-zipUpgrade php53-suhosinUpgrade php53-odbcUpgrade php5-pdoUpgrade php8-exifUpgrade php53-mbstringUpgrade php8-fileinfoUpgrade php53-pearUpgrade php5-opensslUpgrade php8-mbstringUpgrade php8-develUpgrade php53-pgsqlUpgrade php53-bz2Upgrade php5-bcmathUpgrade php5-ldapUpgrade php8-xmlreaderUpgrade php8-tokenizerUpgrade php53-pdoUpgrade php5-gettextUpgrade php53-mysqlUpgrade php53-gmpUpgrade php5-suhosinUpgrade php8-ftpUpgrade php53-ldapUpgrade php5-pcntlUpgrade apache2-mod_php5Upgrade php53-socketsUpgrade php53-sqliteUpgrade php53-mcryptUpgrade php8-mysqlUpgrade php5-hashUpgrade php53-sysvshmUpgrade php5-jsonUpgrade php8-snmpUpgrade php53-readlineUpgrade php8-posix | Feb 17, 2015 | Jul 9, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub