Bug 1573802 (CVE-2018-10546) - CVE-2018-10546 php: Infinite loop in ext/iconv/iconv.c when using stream filter with convert.incov on invalid sequence leads to denial-of-service
Summary: CVE-2018-10546 php: Infinite loop in ext/iconv/iconv.c when using stream filt...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-10546
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1563859 1573816 1578432 1578433 1578434 1578435
Blocks: 1573818 1574650
TreeView+ depends on / blocked
 
Reported: 2018-05-02 09:52 UTC by Adam Mariš
Modified: 2021-12-10 16:04 UTC (History)
11 users (show)

Fixed In Version: php 5.6.36, php 7.0.30, php 7.1.17, php 7.2.5
Doc Type: If docs needed, set a value
Doc Text:
An infinite loop vulnerability was found in ext/iconv/iconv.c in PHP due to the iconv stream not rejecting invalid multibyte sequences. A remote attacker could use this vulnerability to hang the php process and consume resources.
Clone Of:
Environment:
Last Closed: 2019-08-19 08:47:13 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:2519 0 None None None 2019-08-19 08:42:26 UTC

Description Adam Mariš 2018-05-02 09:52:06 UTC 
An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infinite loop exists in ext/iconv/iconv.c because the iconv stream filter does not reject invalid multibyte sequences.

Upstream bug:

https://bugs.php.net/bug.php?id=76249

Upstream patch:

https://git.php.net/?p=php-src.git;a=commit;h=06d309fd7a917575d65c7a6f4f57b0e6bb0f9711
Comment 1 Adam Mariš 2018-05-02 10:04:59 UTC 
Created php tracking bugs for this issue:

Affects: fedora-all [bug 1573816]
Comment 7 Riccardo Schirone 2018-05-15 15:16:46 UTC 
The versions of PHP as provided by Red Hat Enterprise Linux 5, 6 and 7, though they do contain the vulnerable code, cannot be used to trigger the vulnerability with the linked test case. In the provided versions, php://memory stream changed the way it reads data, but we do not exclude other ways to trigger the vulnerability still exist.
Comment 9 Pim Rupert 2018-05-23 15:10:25 UTC 
Is there any update on releasing updated packages for PHP on RHEL 7? (I have no access to the four linked issues.)
Comment 10 errata-xmlrpc 2019-08-19 08:41:06 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2019:2519 https://access.redhat.com/errata/RHSA-2019:2519
Comment 11 Product Security DevOps Team 2019-08-19 08:47:13 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-10546
Note You need to log in before you can comment on or make changes to this bug.