Bug 1377340 (CVE-2016-7416) - CVE-2016-7416 php: Stack based buffer overflow in msgfmt_format_message
Summary: CVE-2016-7416 php: Stack based buffer overflow in msgfmt_format_message
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-7416
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1377366 1554899
Blocks: 1377365
TreeView+ depends on / blocked
 
Reported: 2016-09-19 13:11 UTC by Adam Mariš
Modified: 2020-12-14 07:45 UTC (History)
13 users (show)

Fixed In Version: php 5.6.26, php 7.0.11
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-08 02:58:50 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:1296 0 None None None 2018-05-03 05:05:17 UTC

Description Adam Mariš 2016-09-19 13:11:28 UTC
It was discovered that big locale string causes stack based overflow inside libicu.

PHP bug:

https://bugs.php.net/bug.php?id=73007

PHP patch:

https://github.com/php/php-src/commit/6d55ba265637d6adf0ba7e9c9ef11187d1ec2f5b?w=1

CVE assignment:

http://seclists.org/oss-sec/2016/q3/518

Comment 1 Adam Mariš 2016-09-19 13:37:46 UTC
Created php tracking bugs for this issue:

Affects: fedora-all [bug 1377366]

Comment 2 Huzaifa S. Sidhpurwala 2016-10-12 09:28:14 UTC
Note:

CVE assignment info:

The related upstream code can be found in the
http://source.icu-project.org/repos/icu/icu/trunk/source/common/locid.cpp
file.

What we will do for now is assign one CVE ID for the "ICU for C/C++"
product and a separate CVE ID for PHP. In other words, the bug #73007
discoverer has indicated that it is a bug in that ICU product.
However, it is a bug at a different level within the PHP distribution,
because 6d55ba265637d6adf0ba7e9c9ef11187d1ec2f5b implies that PHP is
intended to operate safely even with an unpatched copy of the ICU
library.

Use CVE-2016-7415 for ICU for C/C++.

Use CVE-2016-7416 for PHP.

(If there happens to be further information indicating that locid.cpp
was supposed to behave as originally written, then we can reject
CVE-2016-7415.)

Comment 4 errata-xmlrpc 2018-05-03 05:05:06 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS

Via RHSA-2018:1296 https://access.redhat.com/errata/RHSA-2018:1296


Note You need to log in before you can comment on or make changes to this bug.