Bug 1377340 – CVE-2016-7416 php: Stack based buffer overflow in msgfmt_format_message

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1377340 - (CVE-2016-7416) CVE-2016-7416 php: Stack based buffer overflow in msgfmt_format_message

Summary:	CVE-2016-7416 php: Stack based buffer overflow in msgfmt_format_message

Status:	NEW

Aliases:	CVE-2016-7416

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20160903,repor...
Keywords:	Security

Depends On:	1377366 1554899
Blocks:	1377365
	Show dependency tree / graph

Reported:	2016-09-19 09:11 EDT by Adam Mariš
Modified:	2018-06-29 18:14 EDT (History)
CC List:	13 users (show)

See Also:
Fixed In Version:	php 5.6.26, php 7.0.11
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2018:1296	None	None	None	2018-05-03 01:05 EDT

Groups: None (edit)

Description Adam Mariš 2016-09-19 09:11:28 EDT

It was discovered that big locale string causes stack based overflow inside libicu.

PHP bug:

https://bugs.php.net/bug.php?id=73007

PHP patch:

https://github.com/php/php-src/commit/6d55ba265637d6adf0ba7e9c9ef11187d1ec2f5b?w=1

CVE assignment:

http://seclists.org/oss-sec/2016/q3/518

Comment 1 Adam Mariš 2016-09-19 09:37:46 EDT

Created php tracking bugs for this issue:

Affects: fedora-all [bug 1377366]

Comment 2 Huzaifa S. Sidhpurwala 2016-10-12 05:28:14 EDT

Note:

CVE assignment info:

The related upstream code can be found in the
http://source.icu-project.org/repos/icu/icu/trunk/source/common/locid.cpp
file.

What we will do for now is assign one CVE ID for the "ICU for C/C++"
product and a separate CVE ID for PHP. In other words, the bug #73007
discoverer has indicated that it is a bug in that ICU product.
However, it is a bug at a different level within the PHP distribution,
because 6d55ba265637d6adf0ba7e9c9ef11187d1ec2f5b implies that PHP is
intended to operate safely even with an unpatched copy of the ICU
library.

Use CVE-2016-7415 for ICU for C/C++.

Use CVE-2016-7416 for PHP.

(If there happens to be further information indicating that locid.cpp
was supposed to behave as originally written, then we can reject
CVE-2016-7415.)

Comment 4 errata-xmlrpc 2018-05-03 01:05:06 EDT

This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS

Via RHSA-2018:1296 https://access.redhat.com/errata/RHSA-2018:1296

Note You need to log in before you can comment on or make changes to this bug.