An infinite loop vulnerability was found in ext/iconv/iconv.c in PHP due to the iconv stream not rejecting invalid multibyte sequences. A remote attacker could use this vulnerability to hang the php process and consume resources.
An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infinite loop exists in ext/iconv/iconv.c because the iconv stream filter does not reject invalid multibyte sequences.
Created php tracking bugs for this issue:
Affects: fedora-all [bug 1573816]
The versions of PHP as provided by Red Hat Enterprise Linux 5, 6 and 7, though they do contain the vulnerable code, cannot be used to trigger the vulnerability with the linked test case. In the provided versions, php://memory stream changed the way it reads data, but we do not exclude other ways to trigger the vulnerability still exist.
Is there any update on releasing updated packages for PHP on RHEL 7? (I have no access to the four linked issues.)