Bug 1573802 – CVE-2018-10546 php: Infinite loop in ext/iconv/iconv.c when using stream filter with convert.incov on invalid sequence leads to denial-of-service

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1573802 - (CVE-2018-10546) CVE-2018-10546 php: Infinite loop in ext/iconv/iconv.c when using stream filter with convert.incov on invalid sequence leads to denial-of-service

Summary:	CVE-2018-10546 php: Infinite loop in ext/iconv/iconv.c when using stream filt...

Status:	NEW

Aliases:	CVE-2018-10546

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20180426,repor...
Keywords:	Security

Depends On:	1563859 1578432 1578433 1578434 1578435 1573816
Blocks:	1574650 1573818
	Show dependency tree / graph

Reported:	2018-05-02 05:52 EDT by Adam Mariš
Modified:	2018-08-17 07:51 EDT (History)
CC List:	11 users (show)

See Also:
Fixed In Version:	php 5.6.36, php 7.0.30, php 7.1.17, php 7.2.5
Doc Type:	If docs needed, set a value
Doc Text:	An infinite loop vulnerability was found in ext/iconv/iconv.c in PHP due to the iconv stream not rejecting invalid multibyte sequences. A remote attacker could use this vulnerability to hang the php process and consume resources.
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Adam Mariš 2018-05-02 05:52:06 EDT

An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infinite loop exists in ext/iconv/iconv.c because the iconv stream filter does not reject invalid multibyte sequences.

Upstream bug:

https://bugs.php.net/bug.php?id=76249

Upstream patch:

https://git.php.net/?p=php-src.git;a=commit;h=06d309fd7a917575d65c7a6f4f57b0e6bb0f9711

Comment 1 Adam Mariš 2018-05-02 06:04:59 EDT

Created php tracking bugs for this issue:

Affects: fedora-all [bug 1573816]

Comment 7 Riccardo Schirone 2018-05-15 11:16:46 EDT

The versions of PHP as provided by Red Hat Enterprise Linux 5, 6 and 7, though they do contain the vulnerable code, cannot be used to trigger the vulnerability with the linked test case. In the provided versions, php://memory stream changed the way it reads data, but we do not exclude other ways to trigger the vulnerability still exist.

Comment 9 Pim Rupert 2018-05-23 11:10:25 EDT

Is there any update on releasing updated packages for PHP on RHEL 7? (I have no access to the four linked issues.)

Note You need to log in before you can comment on or make changes to this bug.